feat(ql3): complete cluster secret binding authority

packages/ql3-cluster-postgres/src/plugin-package/installation/pluginPackageSecretBindingRepository.ts

@@ -180,7 +180,10 @@ export class PostgresPluginPackageSecretBindingRepository
            lock_digest, generation, manifest_digest, authority_kind,
            evidence_digest, bound_at_ms, binding_digest, binding_json
          )
-         SELECT $1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12::jsonb
+         SELECT $1::char(64), $2::varchar(128), $3::varchar(63),
+                $4::varchar(128), $5::char(64), $6::integer, $7::char(64),
+                $8::varchar(32), $9::char(64), $10::bigint, $11::char(64),
+                $12::jsonb
          FROM "ql3"."plugin_package_installs" AS install
          INNER JOIN "ql3"."plugin_package_install_heads" AS head
            ON head.installation_id = install.installation_id

packages/ql3-cluster-postgres/src/plugin-package/secret-binding/pluginPackageSecretBindingApprovalPlanRepository.ts

@@ -1,4 +1,9 @@
 import type { PostgresPool } from '@qinglong/runtime-core';
+import {
+  approvalRequestDigest,
+  normalizeApprovalRequestRecord,
+  type ApprovalRequestRecord,
+} from '@qinglong/runtime-core/approved-action';
 import {
   normalizePluginPackageInstallProposal,
   type PluginPackageInstallProposal,
@@ -86,6 +91,26 @@ function normalizeRow(
   }
 }
 
+function normalizeApprovalRow(row: Row): Readonly<ApprovalRequestRecord> {
+  try {
+    const request = normalizeApprovalRequestRecord(
+      postgresRequiredJsonObject(
+        row.requestJson,
+        unavailable,
+      ) as unknown as ApprovalRequestRecord,
+    );
+    if (
+      approvalRequestDigest(request) !==
+      postgresRequiredString(row.requestDigest, unavailable)
+    ) {
+      throw unavailable();
+    }
+    return request;
+  } catch (error) {
+    throw unavailable(error);
+  }
+}
+
 function same(left: unknown, right: unknown): boolean {
   return JSON.stringify(left) === JSON.stringify(right);
 }
@@ -194,6 +219,36 @@ export class PostgresPluginPackageSecretBindingApprovalPlanReader {
       throw mapStorageError(error);
     }
   }
+
+  async listApprovedRequests(
+    limitValue: number,
+  ): Promise<readonly Readonly<ApprovalRequestRecord>[]> {
+    if (
+      !Number.isSafeInteger(limitValue) ||
+      limitValue < 1 ||
+      limitValue > 64
+    ) {
+      throw new TypeError('Secret binding approval page limit is invalid');
+    }
+    try {
+      const result = await this.pool.query<Row>(
+        `SELECT request.request_json AS "requestJson",
+                request.request_digest AS "requestDigest"
+         FROM "ql3"."approval_requests" AS request
+         JOIN "ql3"."plugin_package_secret_binding_approval_plans" AS plan
+           ON plan.action_ref = request.action_ref
+         WHERE request.state = 'approved'
+           AND request.action_type = 'plugin_package.secret_binding.bind'
+         ORDER BY request.updated_at_ms, request.request_id
+         LIMIT $1`,
+        [limitValue],
+      );
+      if (result.rows.length > limitValue) throw unavailable();
+      return Object.freeze(result.rows.map(normalizeApprovalRow));
+    } catch (error) {
+      throw mapStorageError(error);
+    }
+  }
 }
 
 export class PostgresPluginPackageSecretBindingApprovalPlanRepository