mirror of
https://github.com/whyour/qinglong.git
synced 2026-09-22 19:29:13 +08:00
feat(ql3): complete cluster secret binding authority
This commit is contained in:
whyour
@@ -166,12 +166,14 @@ function database(serverVersionNum = '160014') {
|
||||
'lock_approval_policy_fence',
|
||||
'lock_run_management_policy_fence',
|
||||
'plugin_package_lifecycle_blocking_runs',
|
||||
'plugin_package_secret_binding_planning_snapshot',
|
||||
'plugin_package_automation_start_allowed',
|
||||
'plugin_package_run_start_allowed',
|
||||
'plugin_package_tool_start_allowed',
|
||||
'plugin_package_workflow_admission_snapshot',
|
||||
'plugin_package_workflow_task_attempt_snapshot',
|
||||
'register_plugin_package_automation_disposition_event',
|
||||
'create_plugin_package_secret_binding_approval_plan',
|
||||
].includes(functionName),
|
||||
isOwner: false,
|
||||
})),
|
||||
|
||||
@@ -20,6 +20,9 @@ test('composes one bounded caller-driven cluster Package dispatcher', async () =
|
||||
owner: 'cluster_package_dispatcher_1',
|
||||
clock: () => 100,
|
||||
createId: () => 'dispatcher-id-1',
|
||||
secretExistenceInspector: {
|
||||
async assertExists() {},
|
||||
},
|
||||
});
|
||||
let observedLimit = null;
|
||||
dispatcher.repository.listDueExecutions = async (query) => {
|
||||
|
||||
@@ -17,6 +17,8 @@ function environment(overrides = {}) {
|
||||
QL3_PLUGIN_PACKAGE_EXECUTOR_LEASE_DURATION_MS: '600000',
|
||||
QL3_PLUGIN_PACKAGE_EXECUTOR_REVOCATION_PAGE_SIZE: '8',
|
||||
QL3_PLUGIN_PACKAGE_EXECUTOR_REVOCATION_MAX_PAGES: '4',
|
||||
QL3_PLUGIN_PACKAGE_EXECUTOR_SECRET_ROOT:
|
||||
'/var/run/secrets/qinglong3/plugin-package-values',
|
||||
QL3_POSTGRES_PACKAGE_EXECUTOR_URL:
|
||||
'postgresql://ql3_package_executor:secret@postgres/qinglong',
|
||||
QL3_POSTGRES_TLS_MODE: 'disable',
|
||||
@@ -47,6 +49,10 @@ test('loads bounded low-footprint Package-executor configuration', () => {
|
||||
assert.equal(config.maxBatches, 2);
|
||||
assert.equal(config.revocationPageSize, 8);
|
||||
assert.equal(config.revocationMaxPages, 4);
|
||||
assert.equal(
|
||||
config.secretProjectionRoot,
|
||||
'/var/run/secrets/qinglong3/plugin-package-values',
|
||||
);
|
||||
assert.equal(config.database.pool.maxConnections, 2);
|
||||
assert.equal(config.database.connection.tls.mode, 'disable');
|
||||
});
|
||||
@@ -57,6 +63,7 @@ test('rejects implicit insecure PostgreSQL and unbounded work', () => {
|
||||
environment({ QL3_PLUGIN_PACKAGE_EXECUTOR_MAX_BATCHES: '65' }),
|
||||
environment({ QL3_PLUGIN_PACKAGE_EXECUTOR_REVOCATION_PAGE_SIZE: '129' }),
|
||||
environment({ QL3_PLUGIN_PACKAGE_EXECUTOR_OWNER: 'not safe' }),
|
||||
environment({ QL3_PLUGIN_PACKAGE_EXECUTOR_SECRET_ROOT: 'relative/path' }),
|
||||
]) {
|
||||
assert.throws(
|
||||
() => loadClusterPluginPackageExecutorProcessConfig(invalid),
|
||||
|
||||
@@ -52,6 +52,7 @@ function executorPrivileges() {
|
||||
'project_role_bindings',
|
||||
'approval_requests',
|
||||
'plugin_package_install_proposals',
|
||||
'plugin_package_secret_binding_approval_plans',
|
||||
'plugin_package_task_ownerships',
|
||||
'plugin_package_task_reconciliations',
|
||||
'plugin_package_task_reconciliation_items',
|
||||
@@ -201,6 +202,8 @@ function database(serverVersionNum = '160014') {
|
||||
'plugin_package_workflow_task_attempt_snapshot',
|
||||
'lock_run_management_policy_fence',
|
||||
'register_plugin_package_automation_disposition_event',
|
||||
'create_plugin_package_secret_binding_approval_plan',
|
||||
'plugin_package_secret_binding_planning_snapshot',
|
||||
].includes(functionName),
|
||||
isOwner: false,
|
||||
})),
|
||||
|
||||
@@ -0,0 +1,237 @@
|
||||
'use strict';
|
||||
|
||||
const assert = require('node:assert/strict');
|
||||
const { test } = require('node:test');
|
||||
|
||||
const {
|
||||
createApprovalRequest,
|
||||
decideApprovalRequest,
|
||||
approvalRequestDigest,
|
||||
} = require('@qinglong/runtime-core/approved-action');
|
||||
const {
|
||||
createPluginPackageResourceGeneration,
|
||||
} = require('@qinglong/runtime-core/plugin-package-resource-generation');
|
||||
const {
|
||||
createPluginPackageSecretBindingApprovalPlan,
|
||||
pluginPackageSecretBindingApprovedAction,
|
||||
} = require('@qinglong/runtime-core/plugin-package-secret-binding-approval-plan');
|
||||
const {
|
||||
createPluginPackageSecretBindingPlan,
|
||||
} = require('@qinglong/runtime-core/plugin-package-secret-binding-plan');
|
||||
const { createSecretRef } = require('@qinglong/runtime-core/secret-reference');
|
||||
const {
|
||||
consumeClusterPluginPackageSecretBindingApprovals,
|
||||
} = require('@qinglong/cluster-admin/plugin-package-secret-binding-approval-consumer');
|
||||
|
||||
const REQUESTER = Object.freeze({ type: 'user', id: 'cluster-owner' });
|
||||
const REVIEWER = Object.freeze({ type: 'user', id: 'security-reviewer' });
|
||||
const FENCE = Object.freeze({ projectVersion: 3, bindingVersion: 4 });
|
||||
|
||||
function plan() {
|
||||
const manifest = {
|
||||
apiVersion: 'qinglong.io/v1alpha1',
|
||||
kind: 'Package',
|
||||
metadata: {
|
||||
name: 'example-monitor',
|
||||
displayName: 'Example Monitor',
|
||||
version: '1.0.0',
|
||||
description: 'Secret binding consumer fixture',
|
||||
license: 'Apache-2.0',
|
||||
},
|
||||
spec: {
|
||||
compatibility: {
|
||||
qinglong: '>=3.0.0-0 <4.0.0',
|
||||
architectures: ['arm64'],
|
||||
deploymentProfiles: ['cluster-control'],
|
||||
},
|
||||
runtimes: [],
|
||||
resources: {
|
||||
memory: { recommended: '32Mi' },
|
||||
disk: { install: '4Mi', working: '8Mi' },
|
||||
},
|
||||
permissions: {
|
||||
network: { allowedHosts: [] },
|
||||
secrets: [{ name: 'TOKEN', required: true }],
|
||||
tools: ['secret.use'],
|
||||
},
|
||||
contents: { tasks: [], workflows: [], prompts: [], tools: [] },
|
||||
},
|
||||
};
|
||||
const generation = createPluginPackageResourceGeneration({
|
||||
installationId: 'install-secret-binding-1',
|
||||
projectId: 'project-1',
|
||||
packageName: 'example-monitor',
|
||||
lockDigest: 'a'.repeat(64),
|
||||
generation: 1,
|
||||
previousActiveLockDigest: null,
|
||||
contentDigest: 'b'.repeat(64),
|
||||
contents: manifest.spec.contents,
|
||||
});
|
||||
return createPluginPackageSecretBindingApprovalPlan({
|
||||
actionRef: 'secret-binding:example-monitor-v1',
|
||||
bindingPlan: createPluginPackageSecretBindingPlan({
|
||||
generation,
|
||||
manifest,
|
||||
assignments: [
|
||||
{
|
||||
name: 'TOKEN',
|
||||
secretRef: createSecretRef({
|
||||
projectId: 'project-1',
|
||||
name: 'runtime-token',
|
||||
version: 2,
|
||||
}),
|
||||
},
|
||||
],
|
||||
plannedAtMs: 100,
|
||||
}),
|
||||
requestedBy: REQUESTER,
|
||||
expiresAtMs: 1_000,
|
||||
});
|
||||
}
|
||||
|
||||
function approvedRequest(candidate) {
|
||||
return decideApprovalRequest(
|
||||
createApprovalRequest({
|
||||
id: 'approval-secret-binding-1',
|
||||
projectId: 'project-1',
|
||||
action: pluginPackageSecretBindingApprovedAction(candidate),
|
||||
risk: 'high',
|
||||
decisionMode: 'separation_of_duty',
|
||||
requestedBy: REQUESTER,
|
||||
requestedAtMs: 110,
|
||||
expiresAtMs: 900,
|
||||
requestFence: FENCE,
|
||||
}),
|
||||
{
|
||||
expectedVersion: 1,
|
||||
decisionId: 'decision-secret-binding-1',
|
||||
decision: 'approved',
|
||||
reasonCode: 'reviewed',
|
||||
principal: {
|
||||
subject: REVIEWER,
|
||||
authenticationId: 'auth-reviewer',
|
||||
authenticatedAtMs: 100,
|
||||
expiresAtMs: 800,
|
||||
assurance: 'multi_factor',
|
||||
},
|
||||
decidedAtMs: 120,
|
||||
authorizationFence: FENCE,
|
||||
},
|
||||
);
|
||||
}
|
||||
|
||||
function pool(candidate, request, policyEffect = 'allow') {
|
||||
const dispatches = new Map();
|
||||
return {
|
||||
dispatches,
|
||||
async query(text, values) {
|
||||
if (text.includes('JOIN "ql3"."plugin_package_secret_binding_approval_plans"')) {
|
||||
return {
|
||||
rows: [{
|
||||
requestJson: request,
|
||||
requestDigest: approvalRequestDigest(request),
|
||||
}],
|
||||
};
|
||||
}
|
||||
if (text.includes('FROM "ql3"."plugin_package_secret_binding_approval_plans"')) {
|
||||
return { rows: [{ planJson: candidate }] };
|
||||
}
|
||||
if (text.includes('FROM "ql3"."projects" AS project')) {
|
||||
return policyEffect === 'deny'
|
||||
? { rows: [] }
|
||||
: {
|
||||
rows: [{
|
||||
projectId: 'project-1',
|
||||
projectName: 'Project 1',
|
||||
projectSlug: 'project-1',
|
||||
projectStatus: 'active',
|
||||
projectVersion: 3,
|
||||
projectCreatedAtMs: 1,
|
||||
projectUpdatedAtMs: 2,
|
||||
bindingProjectId: 'project-1',
|
||||
bindingSubjectType: 'user',
|
||||
bindingSubjectId: 'cluster-owner',
|
||||
bindingVersion: 4,
|
||||
bindingState: 'active',
|
||||
bindingRole: 'admin',
|
||||
bindingMutationId: 'binding-owner-v4',
|
||||
bindingChangedByType: 'user',
|
||||
bindingChangedById: 'root-owner',
|
||||
bindingCreatedAtMs: 2,
|
||||
}],
|
||||
};
|
||||
}
|
||||
if (
|
||||
text === 'BEGIN ISOLATION LEVEL SERIALIZABLE' ||
|
||||
text === 'COMMIT' ||
|
||||
text === 'ROLLBACK'
|
||||
) {
|
||||
return { rows: [] };
|
||||
}
|
||||
if (text.includes("SELECT set_config(")) return { rows: [{}] };
|
||||
if (text.includes('lock_approval_policy_fence')) {
|
||||
return { rows: [{ matches: true }] };
|
||||
}
|
||||
if (text.includes('FROM "ql3"."approval_requests"')) {
|
||||
return { rows: [{ requestJson: request, requestDigest: approvalRequestDigest(request) }] };
|
||||
}
|
||||
if (text.includes('INSERT INTO "ql3"."approved_action_dispatches"')) {
|
||||
dispatches.set(values[0], values);
|
||||
return { rows: [], rowCount: 1 };
|
||||
}
|
||||
if (text.includes('INSERT INTO "ql3"."approved_action_executions"')) {
|
||||
return { rows: [], rowCount: 1 };
|
||||
}
|
||||
if (text.includes('UPDATE "ql3"."approval_requests"')) {
|
||||
return { rows: [], rowCount: 1 };
|
||||
}
|
||||
if (text.includes('INSERT INTO "ql3"."security_audit_events"')) {
|
||||
return { rows: [], rowCount: 1 };
|
||||
}
|
||||
throw new Error(`unexpected query: ${text}`);
|
||||
},
|
||||
async connect() {
|
||||
return { query: this.query.bind(this), release() {} };
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
test('consumes one exact approved Secret binding request under a current requester fence', async () => {
|
||||
const candidate = plan();
|
||||
const request = approvedRequest(candidate);
|
||||
const database = pool(candidate, request);
|
||||
const summary = await consumeClusterPluginPackageSecretBindingApprovals({
|
||||
pool: database,
|
||||
now: () => 130,
|
||||
limit: 4,
|
||||
});
|
||||
assert.deepEqual(summary, {
|
||||
scanned: 1,
|
||||
consumed: 1,
|
||||
existing: 0,
|
||||
expired: 0,
|
||||
blocked: 0,
|
||||
});
|
||||
assert.equal(database.dispatches.size, 1);
|
||||
});
|
||||
|
||||
test('does not consume expired or no-longer-authorized approvals', async () => {
|
||||
const candidate = plan();
|
||||
const request = approvedRequest(candidate);
|
||||
assert.deepEqual(
|
||||
await consumeClusterPluginPackageSecretBindingApprovals({
|
||||
pool: pool(candidate, request),
|
||||
now: () => 901,
|
||||
limit: 4,
|
||||
}),
|
||||
{ scanned: 1, consumed: 0, existing: 0, expired: 1, blocked: 0 },
|
||||
);
|
||||
assert.deepEqual(
|
||||
await consumeClusterPluginPackageSecretBindingApprovals({
|
||||
pool: pool(candidate, request, 'deny'),
|
||||
now: () => 130,
|
||||
limit: 4,
|
||||
}),
|
||||
{ scanned: 1, consumed: 0, existing: 0, expired: 0, blocked: 1 },
|
||||
);
|
||||
});
|
||||
@@ -0,0 +1,254 @@
|
||||
'use strict';
|
||||
|
||||
const assert = require('node:assert/strict');
|
||||
const { test } = require('node:test');
|
||||
|
||||
const {
|
||||
consumeApprovalRequest,
|
||||
createApprovalRequest,
|
||||
decideApprovalRequest,
|
||||
} = require('@qinglong/runtime-core/approved-action');
|
||||
const {
|
||||
claimApprovedActionExecution,
|
||||
createApprovedActionExecution,
|
||||
startApprovedActionExecution,
|
||||
} = require('@qinglong/runtime-core/approved-action-execution');
|
||||
const {
|
||||
createPluginPackageResourceGeneration,
|
||||
} = require('@qinglong/runtime-core/plugin-package-resource-generation');
|
||||
const {
|
||||
createPluginPackageSecretBindingApprovalPlan,
|
||||
pluginPackageSecretBindingApprovedAction,
|
||||
} = require('@qinglong/runtime-core/plugin-package-secret-binding-approval-plan');
|
||||
const {
|
||||
createPluginPackageSecretBindingPlan,
|
||||
} = require('@qinglong/runtime-core/plugin-package-secret-binding-plan');
|
||||
const { createSecretRef } = require('@qinglong/runtime-core/secret-reference');
|
||||
const {
|
||||
ClusterPluginPackageSecretBindingApprovedActionHandler,
|
||||
} = require('@qinglong/cluster-admin/plugin-package-secret-binding-approved-action');
|
||||
|
||||
const REQUESTER = Object.freeze({ type: 'user', id: 'cluster-owner' });
|
||||
const REVIEWER = Object.freeze({ type: 'user', id: 'security-reviewer' });
|
||||
const CONSUMER = Object.freeze({
|
||||
type: 'system',
|
||||
id: 'cluster_package_executor',
|
||||
});
|
||||
const FENCE = Object.freeze({ projectVersion: 3, bindingVersion: 4 });
|
||||
|
||||
function approvalPlan() {
|
||||
const manifest = {
|
||||
apiVersion: 'qinglong.io/v1alpha1',
|
||||
kind: 'Package',
|
||||
metadata: {
|
||||
name: 'example-monitor',
|
||||
displayName: 'Example Monitor',
|
||||
version: '1.0.0',
|
||||
description: 'Secret binding handler fixture',
|
||||
license: 'Apache-2.0',
|
||||
},
|
||||
spec: {
|
||||
compatibility: {
|
||||
qinglong: '>=3.0.0-0 <4.0.0',
|
||||
architectures: ['arm64'],
|
||||
deploymentProfiles: ['cluster-control'],
|
||||
},
|
||||
runtimes: [],
|
||||
resources: {
|
||||
memory: { recommended: '32Mi' },
|
||||
disk: { install: '4Mi', working: '8Mi' },
|
||||
},
|
||||
permissions: {
|
||||
network: { allowedHosts: [] },
|
||||
secrets: [{ name: 'TOKEN', required: true }],
|
||||
tools: ['secret.use'],
|
||||
},
|
||||
contents: { tasks: [], workflows: [], prompts: [], tools: [] },
|
||||
},
|
||||
};
|
||||
const generation = createPluginPackageResourceGeneration({
|
||||
installationId: 'install-secret-binding-1',
|
||||
projectId: 'project-1',
|
||||
packageName: 'example-monitor',
|
||||
lockDigest: 'a'.repeat(64),
|
||||
generation: 1,
|
||||
previousActiveLockDigest: null,
|
||||
contentDigest: 'b'.repeat(64),
|
||||
contents: manifest.spec.contents,
|
||||
});
|
||||
const bindingPlan = createPluginPackageSecretBindingPlan({
|
||||
generation,
|
||||
manifest,
|
||||
assignments: [
|
||||
{
|
||||
name: 'TOKEN',
|
||||
secretRef: createSecretRef({
|
||||
projectId: 'project-1',
|
||||
name: 'runtime-token',
|
||||
version: 2,
|
||||
}),
|
||||
},
|
||||
],
|
||||
plannedAtMs: 100,
|
||||
});
|
||||
return createPluginPackageSecretBindingApprovalPlan({
|
||||
actionRef: 'secret-binding:example-monitor-v1',
|
||||
bindingPlan,
|
||||
requestedBy: REQUESTER,
|
||||
expiresAtMs: 1_000,
|
||||
});
|
||||
}
|
||||
|
||||
function dispatch(plan) {
|
||||
const action = pluginPackageSecretBindingApprovedAction(plan);
|
||||
const pending = createApprovalRequest({
|
||||
id: 'approval-secret-binding-1',
|
||||
projectId: plan.bindingPlan.target.projectId,
|
||||
action,
|
||||
risk: 'high',
|
||||
decisionMode: 'separation_of_duty',
|
||||
requestedBy: REQUESTER,
|
||||
requestedAtMs: 110,
|
||||
expiresAtMs: 900,
|
||||
requestFence: FENCE,
|
||||
});
|
||||
const approved = decideApprovalRequest(pending, {
|
||||
expectedVersion: 1,
|
||||
decisionId: 'decision-secret-binding-1',
|
||||
decision: 'approved',
|
||||
reasonCode: 'reviewed',
|
||||
principal: {
|
||||
subject: REVIEWER,
|
||||
authenticationId: 'auth-reviewer',
|
||||
authenticatedAtMs: 100,
|
||||
expiresAtMs: 800,
|
||||
assurance: 'multi_factor',
|
||||
},
|
||||
decidedAtMs: 120,
|
||||
authorizationFence: FENCE,
|
||||
});
|
||||
return consumeApprovalRequest(approved, {
|
||||
expectedVersion: 2,
|
||||
consumptionId: 'consume-secret-binding-1',
|
||||
dispatchId: 'dispatch-secret-binding-1',
|
||||
action,
|
||||
requestedBy: REQUESTER,
|
||||
consumedBy: CONSUMER,
|
||||
consumedAtMs: 130,
|
||||
authorizationFence: FENCE,
|
||||
}).dispatch;
|
||||
}
|
||||
|
||||
function execution(approvedDispatch) {
|
||||
const claimed = claimApprovedActionExecution(
|
||||
createApprovedActionExecution(approvedDispatch, 5),
|
||||
{
|
||||
owner: 'secret-binding-executor',
|
||||
leaseToken: 'lease-secret-binding-1',
|
||||
nowMs: 131,
|
||||
leaseDurationMs: 500,
|
||||
},
|
||||
);
|
||||
assert.equal(claimed.status, 'leased');
|
||||
return startApprovedActionExecution(
|
||||
{ dispatch: approvedDispatch, execution: claimed },
|
||||
{
|
||||
dispatchId: approvedDispatch.id,
|
||||
approvalRequestId: approvedDispatch.approvalRequestId,
|
||||
actionDigest: approvedDispatch.action.actionDigest,
|
||||
owner: claimed.leaseOwner,
|
||||
leaseToken: claimed.leaseToken,
|
||||
expectedVersion: claimed.version,
|
||||
startedAtMs: 140,
|
||||
},
|
||||
);
|
||||
}
|
||||
|
||||
function handler(plan, stored = new Map()) {
|
||||
return new ClusterPluginPackageSecretBindingApprovedActionHandler(
|
||||
{
|
||||
async findByActionRef(actionRef) {
|
||||
return actionRef === plan?.actionRef ? plan : null;
|
||||
},
|
||||
},
|
||||
{
|
||||
async find(generationDigest) {
|
||||
return stored.get(generationDigest) ?? null;
|
||||
},
|
||||
async publish(binding) {
|
||||
const key = binding.target.generationDigest;
|
||||
const existing = stored.get(key);
|
||||
if (existing) return { status: 'existing', binding: existing };
|
||||
stored.set(key, binding);
|
||||
return { status: 'created', binding };
|
||||
},
|
||||
},
|
||||
{
|
||||
async assertExists() {},
|
||||
},
|
||||
);
|
||||
}
|
||||
|
||||
test('publishes exactly the approved content-free binding and replays it', async () => {
|
||||
const plan = approvalPlan();
|
||||
const approvedDispatch = dispatch(plan);
|
||||
const started = execution(approvedDispatch);
|
||||
const stored = new Map();
|
||||
const subject = handler(plan, stored);
|
||||
assert.deepEqual(await subject.inspect(approvedDispatch), {
|
||||
status: 'ready',
|
||||
actionDigest: plan.approvalPlanDigest,
|
||||
});
|
||||
const context = {
|
||||
dispatch: approvedDispatch,
|
||||
execution: started,
|
||||
idempotencyKey: approvedDispatch.id,
|
||||
fence: {
|
||||
owner: started.leaseOwner,
|
||||
leaseToken: started.leaseToken,
|
||||
version: started.version,
|
||||
},
|
||||
};
|
||||
const created = await subject.execute(context);
|
||||
const replay = await subject.execute(context);
|
||||
assert.equal(created.outcome, 'succeeded');
|
||||
assert.equal(created.resultCode, 'package_secret_binding_published');
|
||||
assert.equal(replay.resultCode, 'package_secret_binding_existing');
|
||||
assert.equal(replay.resultDigest, created.resultDigest);
|
||||
const binding = stored.get(plan.bindingPlan.target.generationDigest);
|
||||
assert.equal(binding.authority.kind, 'approved-action-execution');
|
||||
assert.equal(binding.authority.evidenceDigest, plan.approvalPlanDigest);
|
||||
assert.deepEqual(binding.entries, plan.bindingPlan.entries);
|
||||
assert.doesNotMatch(JSON.stringify(binding), /secret-value/);
|
||||
});
|
||||
|
||||
test('blocks missing/drifted plans and rejects a stale execution fence', async () => {
|
||||
const plan = approvalPlan();
|
||||
const approvedDispatch = dispatch(plan);
|
||||
assert.deepEqual(await handler(null).inspect(approvedDispatch), {
|
||||
status: 'blocked',
|
||||
resultCode: 'package_secret_binding_plan_missing',
|
||||
});
|
||||
const drifted = { ...plan, approvalPlanDigest: 'f'.repeat(64) };
|
||||
assert.deepEqual(await handler(drifted).inspect(approvedDispatch), {
|
||||
status: 'blocked',
|
||||
resultCode: 'package_secret_binding_plan_rejected',
|
||||
});
|
||||
const started = execution(approvedDispatch);
|
||||
assert.deepEqual(
|
||||
await handler(plan).execute({
|
||||
dispatch: approvedDispatch,
|
||||
execution: started,
|
||||
idempotencyKey: approvedDispatch.id,
|
||||
fence: {
|
||||
owner: started.leaseOwner,
|
||||
leaseToken: started.leaseToken,
|
||||
version: started.version + 1,
|
||||
},
|
||||
}),
|
||||
{
|
||||
outcome: 'failed',
|
||||
resultCode: 'package_secret_binding_execution_rejected',
|
||||
},
|
||||
);
|
||||
});
|
||||
@@ -0,0 +1,381 @@
|
||||
'use strict';
|
||||
|
||||
const assert = require('node:assert/strict');
|
||||
const { test } = require('node:test');
|
||||
|
||||
const {
|
||||
PLUGIN_PACKAGE_API_VERSION,
|
||||
PLUGIN_PACKAGE_KIND,
|
||||
planPluginPackageInstall,
|
||||
} = require('@qinglong/runtime-core/plugin-package');
|
||||
const {
|
||||
createPluginPackageInstall,
|
||||
createPluginPackageLock,
|
||||
pluginPackageActivationIntentDigest,
|
||||
pluginPackageInstallActionDigest,
|
||||
pluginPackageInstallPlanDigest,
|
||||
transitionPluginPackageInstall,
|
||||
} = require('@qinglong/runtime-core/plugin-package-install');
|
||||
const {
|
||||
createPluginPackageInstallProposal,
|
||||
} = require('@qinglong/runtime-core/plugin-package-proposal');
|
||||
const { createSecretRef } = require('@qinglong/runtime-core/secret-reference');
|
||||
const {
|
||||
PluginPackageManagementAuthorizationError,
|
||||
PluginPackageManagementConflictError,
|
||||
} = require('@qinglong/runtime-core/plugin-package-management');
|
||||
const {
|
||||
createClusterPluginPackageSecretBindingManagementService,
|
||||
} = require('@qinglong/cluster-admin/plugin-package-secret-binding-management');
|
||||
|
||||
const REQUESTER = Object.freeze({
|
||||
subject: Object.freeze({ type: 'user', id: 'cluster-owner' }),
|
||||
authenticationId: 'auth-cluster-owner',
|
||||
authenticatedAtMs: 100,
|
||||
expiresAtMs: 10_000,
|
||||
assurance: 'multi_factor',
|
||||
});
|
||||
const REVIEWER = Object.freeze({
|
||||
subject: Object.freeze({ type: 'user', id: 'security-reviewer' }),
|
||||
authenticationId: 'auth-security-reviewer',
|
||||
authenticatedAtMs: 100,
|
||||
expiresAtMs: 10_000,
|
||||
assurance: 'hardware',
|
||||
});
|
||||
|
||||
function installFixture() {
|
||||
const manifest = {
|
||||
apiVersion: PLUGIN_PACKAGE_API_VERSION,
|
||||
kind: PLUGIN_PACKAGE_KIND,
|
||||
metadata: {
|
||||
name: 'example-monitor',
|
||||
displayName: 'Example Monitor',
|
||||
version: '1.0.0',
|
||||
description: 'Secret binding management fixture',
|
||||
license: 'Apache-2.0',
|
||||
},
|
||||
spec: {
|
||||
compatibility: {
|
||||
qinglong: '>=3.0.0-0 <4.0.0',
|
||||
architectures: ['arm64'],
|
||||
deploymentProfiles: ['cluster-control'],
|
||||
},
|
||||
runtimes: [],
|
||||
resources: {
|
||||
memory: { recommended: '32Mi' },
|
||||
disk: { install: '4Mi', working: '8Mi' },
|
||||
},
|
||||
permissions: {
|
||||
network: { allowedHosts: [] },
|
||||
secrets: [{ name: 'TOKEN', required: true }],
|
||||
tools: ['secret.use'],
|
||||
},
|
||||
contents: { tasks: [], workflows: [], prompts: [], tools: [] },
|
||||
},
|
||||
};
|
||||
const environment = {
|
||||
qinglongVersion: '3.0.0-alpha.0',
|
||||
architecture: 'arm64',
|
||||
deploymentProfile: 'cluster-control',
|
||||
runtimes: [],
|
||||
availableMemoryBytes: 128 * 1024 * 1024,
|
||||
availableDiskBytes: 256 * 1024 * 1024,
|
||||
};
|
||||
const installPlan = planPluginPackageInstall(manifest, environment);
|
||||
const actionInput = {
|
||||
lockId: 'lock-secret-binding-1',
|
||||
projectId: 'project-1',
|
||||
manifest,
|
||||
plan: installPlan,
|
||||
environment,
|
||||
source: {
|
||||
kind: 'offline',
|
||||
locator: `offline:sha256:${'a'.repeat(64)}`,
|
||||
artifactDigest: 'a'.repeat(64),
|
||||
artifactBytes: 2048,
|
||||
contentDigest: 'b'.repeat(64),
|
||||
},
|
||||
architecture: 'arm64',
|
||||
deploymentProfile: 'cluster-control',
|
||||
targetGeneration: 1,
|
||||
};
|
||||
const proposal = createPluginPackageInstallProposal({
|
||||
actionRef: 'proposal:secret-binding-install-v1',
|
||||
actionInput,
|
||||
proposedBy: REQUESTER.subject,
|
||||
proposalFence: { projectVersion: 3, bindingVersion: 4 },
|
||||
createdAtMs: 90,
|
||||
});
|
||||
const lock = createPluginPackageLock({
|
||||
...actionInput,
|
||||
approval: {
|
||||
requestId: 'approval-install-v1',
|
||||
requestVersion: 1,
|
||||
dispatchId: 'dispatch-install-v1',
|
||||
actionDigest: pluginPackageInstallActionDigest(actionInput),
|
||||
previewDigest: pluginPackageInstallPlanDigest(installPlan),
|
||||
approvedBy: { type: 'user', id: 'install-reviewer' },
|
||||
approvedAtMs: 100,
|
||||
expiresAtMs: 2_000,
|
||||
fence: { projectVersion: 3, bindingVersion: 4 },
|
||||
},
|
||||
createdAtMs: 101,
|
||||
});
|
||||
const queued = createPluginPackageInstall(lock, {
|
||||
installationId: 'install-secret-binding-1',
|
||||
mutationId: 'mutation-create',
|
||||
occurredAtMs: 102,
|
||||
});
|
||||
const staged = transitionPluginPackageInstall(lock, queued, {
|
||||
type: 'stage_completed',
|
||||
mutationId: 'mutation-stage',
|
||||
occurredAtMs: 103,
|
||||
stageRef: 'stage-secret-binding-1',
|
||||
artifactDigest: lock.source.artifactDigest,
|
||||
manifestDigest: lock.manifestDigest,
|
||||
contentDigest: lock.source.contentDigest,
|
||||
evidenceDigest: 'c'.repeat(64),
|
||||
});
|
||||
const activating = transitionPluginPackageInstall(lock, staged, {
|
||||
type: 'activation_started',
|
||||
mutationId: 'mutation-activate',
|
||||
occurredAtMs: 104,
|
||||
});
|
||||
const record = transitionPluginPackageInstall(lock, activating, {
|
||||
type: 'activation_committed',
|
||||
mutationId: 'mutation-commit',
|
||||
occurredAtMs: 105,
|
||||
activationRef: 'activation-secret-binding-1',
|
||||
intentDigest: pluginPackageActivationIntentDigest(lock, activating),
|
||||
generation: 1,
|
||||
contentDigest: lock.source.contentDigest,
|
||||
});
|
||||
return { lock, manifest, proposal, record };
|
||||
}
|
||||
|
||||
function policyRow(subjectId, role) {
|
||||
return {
|
||||
projectId: 'project-1',
|
||||
projectName: 'Project 1',
|
||||
projectSlug: 'project-1',
|
||||
projectStatus: 'active',
|
||||
projectVersion: 3,
|
||||
projectCreatedAtMs: 1,
|
||||
projectUpdatedAtMs: 2,
|
||||
bindingProjectId: 'project-1',
|
||||
bindingSubjectType: 'user',
|
||||
bindingSubjectId: subjectId,
|
||||
bindingVersion: 4,
|
||||
bindingState: 'active',
|
||||
bindingRole: role,
|
||||
bindingMutationId: `binding-${subjectId}-v4`,
|
||||
bindingChangedByType: 'user',
|
||||
bindingChangedById: 'root-owner',
|
||||
bindingCreatedAtMs: 2,
|
||||
};
|
||||
}
|
||||
|
||||
function fixture() {
|
||||
const install = installFixture();
|
||||
const plans = new Map();
|
||||
const approvals = new Map();
|
||||
const audits = new Map();
|
||||
const pool = {
|
||||
async query(text, values) {
|
||||
if (text.includes('FROM "ql3"."projects" AS project')) {
|
||||
const role = values[2] === 'cluster-owner' ? 'owner' : 'admin';
|
||||
return { rows: [policyRow(values[2], role)] };
|
||||
}
|
||||
if (text.includes('plugin_package_secret_binding_planning_snapshot')) {
|
||||
return {
|
||||
rows: [{
|
||||
recordJson: install.record,
|
||||
lockJson: install.lock,
|
||||
proposalJson: install.proposal,
|
||||
observedAtMs: 200,
|
||||
}],
|
||||
};
|
||||
}
|
||||
if (text.includes('create_plugin_package_secret_binding_approval_plan')) {
|
||||
const plan = JSON.parse(values[0]);
|
||||
if (plans.has(plan.actionRef)) return { rows: [{ status: 'existing' }] };
|
||||
plans.set(plan.actionRef, plan);
|
||||
return { rows: [{ status: 'created' }] };
|
||||
}
|
||||
if (text.includes('FROM "ql3"."plugin_package_secret_binding_approval_plans"')) {
|
||||
const plan = plans.get(values[0]);
|
||||
return { rows: plan ? [{ planJson: plan }] : [] };
|
||||
}
|
||||
if (text.includes('FROM "ql3"."approval_requests"')) {
|
||||
const request = approvals.get(values[0]);
|
||||
return {
|
||||
rows: request
|
||||
? [{ requestJson: request, requestDigest: require('@qinglong/runtime-core/approved-action').approvalRequestDigest(request) }]
|
||||
: [],
|
||||
};
|
||||
}
|
||||
throw new Error(`unexpected pool query: ${text}`);
|
||||
},
|
||||
async connect() {
|
||||
const client = {
|
||||
async query(text, values) {
|
||||
if (
|
||||
text === 'BEGIN ISOLATION LEVEL SERIALIZABLE' ||
|
||||
text === 'COMMIT' ||
|
||||
text === 'ROLLBACK' ||
|
||||
text.includes('set_config')
|
||||
) return { rows: [] };
|
||||
if (text.includes('lock_approval_policy_fence')) {
|
||||
return { rows: [{ matches: true }] };
|
||||
}
|
||||
if (text.includes('FROM "ql3"."approval_requests"')) {
|
||||
const request = approvals.get(values[0]);
|
||||
return { rows: request ? [{ requestJson: request, requestDigest: require('@qinglong/runtime-core/approved-action').approvalRequestDigest(request) }] : [] };
|
||||
}
|
||||
if (text.includes('FROM "ql3"."security_audit_events"')) {
|
||||
const audit = audits.get(values[0]);
|
||||
return { rows: audit ? [audit] : [] };
|
||||
}
|
||||
if (text.includes('INSERT INTO "ql3"."approval_requests"')) {
|
||||
approvals.set(values[0], JSON.parse(values[14]));
|
||||
return { rows: [], rowCount: 1 };
|
||||
}
|
||||
if (text.includes('UPDATE "ql3"."approval_requests"')) {
|
||||
approvals.set(values[8], JSON.parse(values[5]));
|
||||
return { rows: [], rowCount: 1 };
|
||||
}
|
||||
if (text.includes('INSERT INTO "ql3"."security_audit_events"')) {
|
||||
audits.set(values[0], {
|
||||
eventId: values[0], requestId: values[1], operationId: values[2],
|
||||
projectId: values[3], subjectType: values[4], subjectId: values[5],
|
||||
authenticationId: values[6], outcome: values[7],
|
||||
reasonsJson: JSON.parse(values[8]), fenceProjectVersion: values[9],
|
||||
fenceBindingVersion: values[10], occurredAtMs: values[11],
|
||||
});
|
||||
return { rows: [], rowCount: 1 };
|
||||
}
|
||||
throw new Error(`unexpected transaction query: ${text}`);
|
||||
},
|
||||
release() {},
|
||||
};
|
||||
return client;
|
||||
},
|
||||
};
|
||||
return { approvals, plans, pool };
|
||||
}
|
||||
|
||||
function planRequest(overrides = {}) {
|
||||
return {
|
||||
actionRef: 'secret-binding:example-monitor-v1',
|
||||
projectId: 'project-1',
|
||||
packageName: 'example-monitor',
|
||||
assignments: [{
|
||||
name: 'TOKEN',
|
||||
secretRef: createSecretRef({
|
||||
projectId: 'project-1',
|
||||
name: 'runtime-token',
|
||||
version: 2,
|
||||
}),
|
||||
}],
|
||||
principal: REQUESTER,
|
||||
...overrides,
|
||||
};
|
||||
}
|
||||
|
||||
test('plans, proposes and independently decides one exact Secret binding', async () => {
|
||||
const state = fixture();
|
||||
let clock = 210;
|
||||
const service = createClusterPluginPackageSecretBindingManagementService({
|
||||
pool: state.pool,
|
||||
now: () => clock,
|
||||
planLifetimeMs: 1_000,
|
||||
approvalLifetimeMs: 1_000,
|
||||
});
|
||||
const created = await service.plan(planRequest());
|
||||
clock = 300;
|
||||
const replay = await service.plan(planRequest());
|
||||
assert.equal(created.status, 'created');
|
||||
assert.equal(replay.status, 'existing');
|
||||
assert.deepEqual(replay.plan, created.plan);
|
||||
assert.equal(created.plan.bindingPlan.plannedAtMs, 200);
|
||||
assert.equal(created.plan.expiresAtMs, 1_200);
|
||||
assert.deepEqual(created.plan.bindingPlan.entries, [{
|
||||
name: 'TOKEN',
|
||||
required: true,
|
||||
secretRef: planRequest().assignments[0].secretRef,
|
||||
}]);
|
||||
|
||||
const proposed = await service.propose({
|
||||
actionRef: created.plan.actionRef,
|
||||
approvalRequestId: 'approval-secret-binding-1',
|
||||
approvalAuditEventId: '123e4567-e89b-42d3-a456-426614175201',
|
||||
principal: REQUESTER,
|
||||
});
|
||||
assert.equal(proposed.approvalStatus, 'created');
|
||||
assert.equal(proposed.approvalRequest.decisionMode, 'separation_of_duty');
|
||||
assert.equal(proposed.approvalRequest.risk, 'high');
|
||||
assert.equal(proposed.approvalRequest.action.permission, 'secret.manage');
|
||||
|
||||
clock = 350;
|
||||
const decided = await service.decide({
|
||||
actionRef: created.plan.actionRef,
|
||||
approvalRequestId: proposed.approvalRequest.id,
|
||||
expectedVersion: 1,
|
||||
decisionId: 'decision-secret-binding-1',
|
||||
auditEventId: '123e4567-e89b-42d3-a456-426614175202',
|
||||
decision: 'approved',
|
||||
reasonCode: 'reviewed',
|
||||
principal: REVIEWER,
|
||||
});
|
||||
assert.equal(decided.status, 'decided');
|
||||
assert.equal(decided.request.state, 'approved');
|
||||
assert.deepEqual(decided.request.decidedBy, REVIEWER.subject);
|
||||
});
|
||||
|
||||
test('rejects weak requester, self-decision and semantic actionRef replay drift', async () => {
|
||||
const state = fixture();
|
||||
const service = createClusterPluginPackageSecretBindingManagementService({
|
||||
pool: state.pool,
|
||||
now: () => 210,
|
||||
planLifetimeMs: 1_000,
|
||||
});
|
||||
await assert.rejects(
|
||||
service.plan(planRequest({
|
||||
principal: { ...REQUESTER, assurance: 'single_factor' },
|
||||
})),
|
||||
PluginPackageManagementAuthorizationError,
|
||||
);
|
||||
const created = await service.plan(planRequest());
|
||||
await assert.rejects(
|
||||
service.plan(planRequest({
|
||||
assignments: [{
|
||||
name: 'TOKEN',
|
||||
secretRef: createSecretRef({
|
||||
projectId: 'project-1',
|
||||
name: 'another-token',
|
||||
version: 2,
|
||||
}),
|
||||
}],
|
||||
})),
|
||||
PluginPackageManagementConflictError,
|
||||
);
|
||||
const proposed = await service.propose({
|
||||
actionRef: created.plan.actionRef,
|
||||
approvalRequestId: 'approval-secret-binding-1',
|
||||
approvalAuditEventId: '123e4567-e89b-42d3-a456-426614175201',
|
||||
principal: REQUESTER,
|
||||
});
|
||||
await assert.rejects(
|
||||
service.decide({
|
||||
actionRef: created.plan.actionRef,
|
||||
approvalRequestId: proposed.approvalRequest.id,
|
||||
expectedVersion: 1,
|
||||
decisionId: 'decision-secret-binding-self',
|
||||
auditEventId: '123e4567-e89b-42d3-a456-426614175203',
|
||||
decision: 'approved',
|
||||
reasonCode: 'reviewed',
|
||||
principal: REQUESTER,
|
||||
}),
|
||||
(error) => error?.name === 'ApprovalSeparationOfDutyError',
|
||||
);
|
||||
});
|
||||
+471
@@ -0,0 +1,471 @@
|
||||
'use strict';
|
||||
|
||||
const assert = require('node:assert/strict');
|
||||
const { randomBytes, randomUUID } = require('node:crypto');
|
||||
const { mkdirSync, rmSync, writeFileSync } = require('node:fs');
|
||||
const { tmpdir } = require('node:os');
|
||||
const { join } = require('node:path');
|
||||
const { test } = require('node:test');
|
||||
|
||||
const {
|
||||
createPostgresDatabaseOpener,
|
||||
PostgresPluginPackageSecretBindingApprovalPlanReader,
|
||||
PostgresPluginPackageSecretBindingRepository,
|
||||
} = require('@qinglong/cluster-postgres/package-executor');
|
||||
const {
|
||||
PostgresApprovedActionExecutionRepository,
|
||||
} = require('@qinglong/cluster-postgres/approved-action-execution');
|
||||
const {
|
||||
runPostgresMigrations,
|
||||
} = require('@qinglong/cluster-postgres/migration');
|
||||
const {
|
||||
PostgresApprovalRequestRepository,
|
||||
} = require('@qinglong/cluster-postgres/approved-action');
|
||||
const {
|
||||
PostgresPluginPackageInstallRepository,
|
||||
} = require('@qinglong/cluster-postgres/plugin-package-install');
|
||||
const {
|
||||
PLUGIN_PACKAGE_API_VERSION,
|
||||
PLUGIN_PACKAGE_KIND,
|
||||
planPluginPackageInstall,
|
||||
} = require('@qinglong/runtime-core/plugin-package');
|
||||
const {
|
||||
pluginPackageInstallCommit,
|
||||
pluginPackageActivationIntentDigest,
|
||||
transitionPluginPackageInstall,
|
||||
} = require('@qinglong/runtime-core/plugin-package-install');
|
||||
const {
|
||||
createPluginPackagePublisherProvenance,
|
||||
} = require('@qinglong/runtime-core/plugin-package-publisher-provenance');
|
||||
const { createSecretRef } = require('@qinglong/runtime-core/secret-reference');
|
||||
const {
|
||||
secretProjectionFileName,
|
||||
} = require('@qinglong/runtime-core/secret-projection');
|
||||
const {
|
||||
createClusterPluginPackageManagementService,
|
||||
} = require('@qinglong/cluster-admin/plugin-package-management');
|
||||
const {
|
||||
createClusterPluginPackageApprovedActionDispatcher,
|
||||
} = require('@qinglong/cluster-admin/plugin-package-approved-action');
|
||||
const {
|
||||
createClusterPluginPackageSecretBindingManagementService,
|
||||
} = require('@qinglong/cluster-admin/plugin-package-secret-binding-management');
|
||||
const {
|
||||
consumeClusterPluginPackageSecretBindingApprovals,
|
||||
} = require('@qinglong/cluster-admin/plugin-package-secret-binding-approval-consumer');
|
||||
const {
|
||||
ProjectedPluginPackageSecretExistenceInspector,
|
||||
} = require('@qinglong/cluster-admin/plugin-package-secret-existence-inspector');
|
||||
const {
|
||||
ClusterPluginPackageSecretBindingApprovedActionHandler,
|
||||
} = require('@qinglong/cluster-admin/plugin-package-secret-binding-approved-action');
|
||||
|
||||
const MIGRATION_URL =
|
||||
process.env.QL3_TEST_POSTGRES_MIGRATION_URL ??
|
||||
process.env.QL3_TEST_POSTGRES_URL;
|
||||
const MANAGER_URL = process.env.QL3_TEST_POSTGRES_PACKAGE_MANAGER_URL;
|
||||
const EXECUTOR_URL = process.env.QL3_TEST_POSTGRES_PACKAGE_EXECUTOR_URL;
|
||||
|
||||
function opener(role, connectionString, applicationName) {
|
||||
return createPostgresDatabaseOpener({
|
||||
role,
|
||||
connection: { connectionString, tls: { mode: 'disable' } },
|
||||
pool: { maxConnections: 2, applicationName },
|
||||
onPoolError(error) {
|
||||
throw error;
|
||||
},
|
||||
});
|
||||
}
|
||||
|
||||
function principal(subject, authenticationId, now) {
|
||||
return Object.freeze({
|
||||
subject,
|
||||
authenticationId,
|
||||
authenticatedAtMs: now - 1,
|
||||
expiresAtMs: now + 120_000,
|
||||
assurance: 'multi_factor',
|
||||
});
|
||||
}
|
||||
|
||||
function audit(eventId, requestId, operationId, projectId, subject, now, fence) {
|
||||
return Object.freeze({
|
||||
eventId,
|
||||
requestId,
|
||||
operationId,
|
||||
projectId,
|
||||
subject,
|
||||
authenticationId: 'cluster-secret-binding-integration',
|
||||
outcome: 'allowed',
|
||||
reasons: Object.freeze(['package_review']),
|
||||
fence,
|
||||
occurredAtMs: now,
|
||||
});
|
||||
}
|
||||
|
||||
if (!MIGRATION_URL || !MANAGER_URL || !EXECUTOR_URL) {
|
||||
test('Cluster Secret binding PostgreSQL integration requires three role URLs', {
|
||||
skip: true,
|
||||
});
|
||||
} else {
|
||||
test('plans, approves, consumes and publishes one Secret binding through real PostgreSQL roles', async () => {
|
||||
const suffix = randomBytes(4).toString('hex');
|
||||
const projectId = `secret-binding-${suffix}`;
|
||||
const packageName = `secret-binding-${suffix}`;
|
||||
const requesterSubject = Object.freeze({ type: 'user', id: `owner-${suffix}` });
|
||||
const reviewerSubject = Object.freeze({ type: 'user', id: `reviewer-${suffix}` });
|
||||
const fence = Object.freeze({ projectVersion: 1, bindingVersion: 1 });
|
||||
let now = Date.now();
|
||||
const migration = await opener('migration', MIGRATION_URL, `ql3-secret-migrate-${suffix}`)();
|
||||
const manager = await opener('package-manager', MANAGER_URL, `ql3-secret-manager-${suffix}`)();
|
||||
const executor = await opener('package-executor', EXECUTOR_URL, `ql3-secret-executor-${suffix}`)();
|
||||
const projectionRoot = join(tmpdir(), `ql3-secret-projection-${suffix}`);
|
||||
mkdirSync(projectionRoot, { mode: 0o700 });
|
||||
try {
|
||||
await runPostgresMigrations({ pool: migration.pool });
|
||||
await migration.pool.query(
|
||||
`INSERT INTO "ql3"."projects" (
|
||||
id, name, slug, status, version, created_at_ms, updated_at_ms
|
||||
) VALUES ($1, $1, $1, 'active', 1, $2, $2)`,
|
||||
[projectId, now],
|
||||
);
|
||||
await migration.pool.query(
|
||||
`INSERT INTO "ql3"."project_role_bindings" (
|
||||
project_id, subject_type, subject_id, version, state, role,
|
||||
mutation_id, changed_by_type, changed_by_id, created_at_ms
|
||||
) VALUES
|
||||
($1, 'user', $2, 1, 'active', 'owner', $4, 'system', 'integration', $5),
|
||||
($1, 'user', $3, 1, 'active', 'admin', $6, 'system', 'integration', $5)`,
|
||||
[
|
||||
projectId,
|
||||
requesterSubject.id,
|
||||
reviewerSubject.id,
|
||||
`grant-owner-${suffix}`,
|
||||
now,
|
||||
`grant-reviewer-${suffix}`,
|
||||
],
|
||||
);
|
||||
|
||||
const manifest = Object.freeze({
|
||||
apiVersion: PLUGIN_PACKAGE_API_VERSION,
|
||||
kind: PLUGIN_PACKAGE_KIND,
|
||||
metadata: {
|
||||
name: packageName,
|
||||
displayName: 'Secret binding PostgreSQL integration',
|
||||
version: '1.0.0',
|
||||
description: 'One bounded content-free Secret binding fixture',
|
||||
license: 'Apache-2.0',
|
||||
},
|
||||
spec: {
|
||||
compatibility: {
|
||||
qinglong: '>=3.0.0-0 <4.0.0',
|
||||
architectures: ['arm64'],
|
||||
deploymentProfiles: ['cluster-control'],
|
||||
},
|
||||
runtimes: [],
|
||||
resources: {
|
||||
memory: { recommended: '16Mi' },
|
||||
disk: { install: '4Mi', working: '8Mi' },
|
||||
},
|
||||
permissions: {
|
||||
network: { allowedHosts: [] },
|
||||
secrets: [{ name: 'TOKEN', required: false }],
|
||||
tools: ['secret.use'],
|
||||
},
|
||||
contents: { tasks: [], workflows: [], prompts: [], tools: [] },
|
||||
},
|
||||
});
|
||||
const environment = Object.freeze({
|
||||
qinglongVersion: '3.0.0-alpha.0',
|
||||
architecture: 'arm64',
|
||||
deploymentProfile: 'cluster-control',
|
||||
runtimes: [],
|
||||
availableMemoryBytes: 128 * 1024 * 1024,
|
||||
availableDiskBytes: 256 * 1024 * 1024,
|
||||
});
|
||||
const installPlan = planPluginPackageInstall(manifest, environment);
|
||||
const actionInput = Object.freeze({
|
||||
lockId: `lock-${suffix}`,
|
||||
projectId,
|
||||
manifest,
|
||||
plan: installPlan,
|
||||
environment,
|
||||
source: {
|
||||
kind: 'offline',
|
||||
locator: `offline:sha256:${'a'.repeat(64)}`,
|
||||
artifactDigest: 'a'.repeat(64),
|
||||
artifactBytes: 2048,
|
||||
contentDigest: 'b'.repeat(64),
|
||||
},
|
||||
architecture: 'arm64',
|
||||
deploymentProfile: 'cluster-control',
|
||||
targetGeneration: 1,
|
||||
});
|
||||
const installActionRef = `install:${packageName}:v1`;
|
||||
const installApprovalId = `install-approval-${suffix}`;
|
||||
const installManagement = createClusterPluginPackageManagementService({
|
||||
pool: manager.pool,
|
||||
now: () => now,
|
||||
approvalLifetimeMs: 60_000,
|
||||
});
|
||||
const proposed = await installManagement.propose({
|
||||
actionRef: installActionRef,
|
||||
approvalRequestId: installApprovalId,
|
||||
proposalAuditEventId: randomUUID(),
|
||||
approvalAuditEventId: randomUUID(),
|
||||
requestedAtMs: now,
|
||||
actionInput,
|
||||
principal: principal(requesterSubject, `install-owner-${suffix}`, now),
|
||||
});
|
||||
now += 10;
|
||||
const installDecision = await installManagement.decide({
|
||||
approvalRequestId: installApprovalId,
|
||||
expectedVersion: proposed.approvalRequest.version,
|
||||
decisionId: `install-decision-${suffix}`,
|
||||
auditEventId: randomUUID(),
|
||||
decision: 'approved',
|
||||
reasonCode: 'reviewed',
|
||||
decidedAtMs: now,
|
||||
principal: principal(reviewerSubject, `install-reviewer-${suffix}`, now),
|
||||
});
|
||||
assert.equal(installDecision.status, 'decided');
|
||||
now += 10;
|
||||
const installConsumed = await new PostgresApprovalRequestRepository(
|
||||
executor.pool,
|
||||
).consume({
|
||||
requestId: installApprovalId,
|
||||
expectedVersion: installDecision.request.version,
|
||||
consumptionId: `install-consume-${suffix}`,
|
||||
dispatchId: `install-dispatch-${suffix}`,
|
||||
action: installDecision.request.action,
|
||||
requestedBy: requesterSubject,
|
||||
consumedBy: { type: 'system', id: 'cluster_package_executor' },
|
||||
consumedAtMs: now,
|
||||
authorizationFence: fence,
|
||||
audit: audit(
|
||||
randomUUID(),
|
||||
installApprovalId,
|
||||
'approval.consume',
|
||||
projectId,
|
||||
{ type: 'system', id: 'cluster_package_executor' },
|
||||
now,
|
||||
fence,
|
||||
),
|
||||
});
|
||||
assert.equal(installConsumed.status, 'consumed');
|
||||
let id = 0;
|
||||
now += 10;
|
||||
const installDispatch = await createClusterPluginPackageApprovedActionDispatcher({
|
||||
pool: executor.pool,
|
||||
owner: `install-executor-${suffix}`,
|
||||
clock: () => now,
|
||||
createId: () => `install-executor-id-${suffix}-${++id}`,
|
||||
secretExistenceInspector: { async assertExists() {} },
|
||||
}).dispatchBatch({ limit: 4 });
|
||||
assert.equal(installDispatch.succeeded, 1);
|
||||
|
||||
const installs = new PostgresPluginPackageInstallRepository(executor.pool);
|
||||
const queued = await installs.find(projectId, packageName);
|
||||
assert.ok(queued);
|
||||
const lock = await installs.findLock(queued.lockDigest);
|
||||
assert.ok(lock);
|
||||
now += 10;
|
||||
const staged = transitionPluginPackageInstall(lock, queued, {
|
||||
type: 'stage_completed',
|
||||
mutationId: `stage-${suffix}`,
|
||||
occurredAtMs: now,
|
||||
stageRef: `stage:${lock.lockDigest}`,
|
||||
artifactDigest: lock.source.artifactDigest,
|
||||
manifestDigest: lock.manifestDigest,
|
||||
contentDigest: lock.source.contentDigest,
|
||||
evidenceDigest: 'c'.repeat(64),
|
||||
});
|
||||
const provenance = createPluginPackagePublisherProvenance({
|
||||
projectId,
|
||||
packageName,
|
||||
installationId: queued.installationId,
|
||||
lockDigest: lock.lockDigest,
|
||||
artifactDigest: staged.stageReceipt.artifactDigest,
|
||||
manifestDigest: staged.stageReceipt.manifestDigest,
|
||||
contentDigest: staged.stageReceipt.contentDigest,
|
||||
stageEvidenceDigest: staged.stageReceipt.evidenceDigest,
|
||||
signature: {
|
||||
publisher: 'integration.qinglong.dev',
|
||||
keyId: 'integration-key-1',
|
||||
signatureDigest: 'd'.repeat(64),
|
||||
keyNotBeforeMs: now - 1,
|
||||
keyNotAfterMs: now + 60_000,
|
||||
verifiedAtMs: now,
|
||||
},
|
||||
});
|
||||
await executor.pool.query(
|
||||
`INSERT INTO "ql3"."plugin_package_publisher_provenance" (
|
||||
installation_id, project_id, package_name, lock_digest,
|
||||
artifact_digest, manifest_digest, content_digest,
|
||||
stage_evidence_digest, publisher, key_id, signature_digest,
|
||||
key_not_before_ms, key_not_after_ms, verified_at_ms,
|
||||
provenance_digest, provenance_json
|
||||
) VALUES (
|
||||
$1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11,
|
||||
$12, $13, $14, $15, $16::jsonb
|
||||
)`,
|
||||
[
|
||||
provenance.installationId,
|
||||
provenance.projectId,
|
||||
provenance.packageName,
|
||||
provenance.lockDigest,
|
||||
provenance.artifactDigest,
|
||||
provenance.manifestDigest,
|
||||
provenance.contentDigest,
|
||||
provenance.stageEvidenceDigest,
|
||||
provenance.publisher,
|
||||
provenance.keyId,
|
||||
provenance.signatureDigest,
|
||||
provenance.keyNotBeforeMs,
|
||||
provenance.keyNotAfterMs,
|
||||
provenance.verifiedAtMs,
|
||||
provenance.provenanceDigest,
|
||||
JSON.stringify(provenance),
|
||||
],
|
||||
);
|
||||
await installs.commit(pluginPackageInstallCommit(queued, staged));
|
||||
now += 10;
|
||||
const activating = transitionPluginPackageInstall(lock, staged, {
|
||||
type: 'activation_started',
|
||||
mutationId: `activate-${suffix}`,
|
||||
occurredAtMs: now,
|
||||
});
|
||||
await installs.commit(pluginPackageInstallCommit(staged, activating));
|
||||
now += 10;
|
||||
const active = transitionPluginPackageInstall(lock, activating, {
|
||||
type: 'activation_committed',
|
||||
mutationId: `commit-${suffix}`,
|
||||
occurredAtMs: now,
|
||||
activationRef: `active:${lock.lockDigest}`,
|
||||
intentDigest: pluginPackageActivationIntentDigest(lock, activating),
|
||||
generation: 1,
|
||||
contentDigest: lock.source.contentDigest,
|
||||
});
|
||||
await installs.commit(pluginPackageInstallCommit(activating, active));
|
||||
|
||||
const secretRef = createSecretRef({
|
||||
projectId,
|
||||
name: 'runtime-token',
|
||||
version: 1,
|
||||
});
|
||||
writeFileSync(join(projectionRoot, secretProjectionFileName(secretRef)), '', {
|
||||
mode: 0o440,
|
||||
});
|
||||
const secretActionRef = `secret-binding:${packageName}:v1`;
|
||||
const secretApprovalId = `secret-approval-${suffix}`;
|
||||
const secretManagement = createClusterPluginPackageSecretBindingManagementService({
|
||||
pool: manager.pool,
|
||||
now: () => now,
|
||||
planLifetimeMs: 60_000,
|
||||
approvalLifetimeMs: 60_000,
|
||||
});
|
||||
const planned = await secretManagement.plan({
|
||||
actionRef: secretActionRef,
|
||||
projectId,
|
||||
packageName,
|
||||
assignments: [{ name: 'TOKEN', secretRef }],
|
||||
principal: principal(requesterSubject, `secret-owner-${suffix}`, now),
|
||||
});
|
||||
assert.equal(planned.status, 'created');
|
||||
now = Math.max(now, planned.plan.bindingPlan.plannedAtMs);
|
||||
const replay = await secretManagement.plan({
|
||||
actionRef: secretActionRef,
|
||||
projectId,
|
||||
packageName,
|
||||
assignments: [{ name: 'TOKEN', secretRef }],
|
||||
principal: principal(requesterSubject, `secret-owner-${suffix}`, now),
|
||||
});
|
||||
assert.equal(replay.status, 'existing');
|
||||
now += 10;
|
||||
const secretProposed = await secretManagement.propose({
|
||||
actionRef: secretActionRef,
|
||||
approvalRequestId: secretApprovalId,
|
||||
approvalAuditEventId: randomUUID(),
|
||||
principal: principal(requesterSubject, `secret-owner-${suffix}`, now),
|
||||
});
|
||||
now += 10;
|
||||
const secretDecision = await secretManagement.decide({
|
||||
actionRef: secretActionRef,
|
||||
approvalRequestId: secretApprovalId,
|
||||
expectedVersion: secretProposed.approvalRequest.version,
|
||||
decisionId: `secret-decision-${suffix}`,
|
||||
auditEventId: randomUUID(),
|
||||
decision: 'approved',
|
||||
reasonCode: 'reviewed',
|
||||
principal: principal(reviewerSubject, `secret-reviewer-${suffix}`, now),
|
||||
});
|
||||
assert.equal(secretDecision.status, 'decided');
|
||||
now += 10;
|
||||
assert.deepEqual(
|
||||
await consumeClusterPluginPackageSecretBindingApprovals({
|
||||
pool: executor.pool,
|
||||
now: () => now,
|
||||
limit: 4,
|
||||
}),
|
||||
{ scanned: 1, consumed: 1, existing: 0, expired: 0, blocked: 0 },
|
||||
);
|
||||
const inspector = new ProjectedPluginPackageSecretExistenceInspector({
|
||||
rootDirectory: projectionRoot,
|
||||
});
|
||||
await inspector.assertExists([secretRef]);
|
||||
const consumedSecretApproval =
|
||||
await new PostgresApprovalRequestRepository(executor.pool).findById(
|
||||
secretApprovalId,
|
||||
);
|
||||
assert.ok(consumedSecretApproval?.dispatchId);
|
||||
const pendingSecretExecution =
|
||||
await new PostgresApprovedActionExecutionRepository(
|
||||
executor.pool,
|
||||
).findExecutionByDispatchId(consumedSecretApproval.dispatchId);
|
||||
assert.ok(pendingSecretExecution);
|
||||
assert.deepEqual(
|
||||
await new ClusterPluginPackageSecretBindingApprovedActionHandler(
|
||||
new PostgresPluginPackageSecretBindingApprovalPlanReader(
|
||||
executor.pool,
|
||||
),
|
||||
new PostgresPluginPackageSecretBindingRepository(executor.pool),
|
||||
inspector,
|
||||
).inspect(pendingSecretExecution.dispatch),
|
||||
{
|
||||
status: 'ready',
|
||||
actionDigest: planned.plan.approvalPlanDigest,
|
||||
},
|
||||
);
|
||||
id = 0;
|
||||
now += 10;
|
||||
const secretDispatcher = createClusterPluginPackageApprovedActionDispatcher({
|
||||
pool: executor.pool,
|
||||
owner: `secret-executor-${suffix}`,
|
||||
clock: () => now,
|
||||
createId: () => `secret-executor-id-${suffix}-${++id}`,
|
||||
secretExistenceInspector: inspector,
|
||||
});
|
||||
const secretDispatch = await secretDispatcher.dispatchBatch({ limit: 4 });
|
||||
assert.equal(secretDispatch.succeeded, 1);
|
||||
const bindings = new PostgresPluginPackageSecretBindingRepository(executor.pool);
|
||||
const binding = await bindings.find(
|
||||
planned.plan.bindingPlan.target.generationDigest,
|
||||
);
|
||||
assert.ok(binding);
|
||||
assert.equal(binding.authority.kind, 'approved-action-execution');
|
||||
assert.equal(binding.authority.evidenceDigest, planned.plan.approvalPlanDigest);
|
||||
assert.deepEqual(binding.entries, planned.plan.bindingPlan.entries);
|
||||
assert.doesNotMatch(JSON.stringify(binding), /secret-value/);
|
||||
assert.equal((await secretDispatcher.dispatchBatch({ limit: 4 })).scanned, 0);
|
||||
await assert.rejects(
|
||||
manager.pool.query(
|
||||
`SELECT * FROM "ql3"."plugin_package_secret_bindings" WHERE generation_digest = $1`,
|
||||
[binding.target.generationDigest],
|
||||
),
|
||||
(error) => error?.code === '42501',
|
||||
);
|
||||
} finally {
|
||||
await Promise.all([migration.close(), manager.close(), executor.close()]);
|
||||
rmSync(projectionRoot, { recursive: true, force: true });
|
||||
}
|
||||
});
|
||||
}
|
||||
Reference in New Issue
Block a user