open-source/qinglong
1
0
Fork 0
mirror of https://github.com/whyour/qinglong.git synced 2026-09-22 02:27:44 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(ql3): add generic worker management entry

Browse Source
This commit is contained in:
whyour
2026-08-20 13:30:06 +08:00
parent 4a4fa85f51
commit af5d5bfc0b
20 changed files with 1191 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/ql3-cluster-admin/test/workerCredentialManagementHttp.test.cjs
+44 -4
View File
@@ -56,6 +56,7 @@ const NEXT_CLIENT_KEY = resolve(
'fixtures/management-service-key.pem',
);
const WORKER_PATH = '/api/v3/worker-credentials/management';
const CANONICAL_WORKER_PATH = '/api/v3/workers/management';
function command() {
return {
@@ -223,7 +224,7 @@ async function requestWithClientIdentity(application, certificate, key) {
});
}
test('serves only the fixed Worker credential management route', async () => {
test('serves the canonical Worker route and exact credential compatibility alias', async () => {
const calls = [];
const application = await start(async (value, authentication) => {
calls.push({ value, principal: await authentication.authenticate() });
@@ -245,12 +246,15 @@ test('serves only the fixed Worker credential management route', async () => {
type: 'user',
id: 'cluster-reviewer',
});
const canonical = await request(application, CANONICAL_WORKER_PATH);
assert.equal(canonical.statusCode, 200);
assert.equal(canonical.body.result.operation, 'worker-credential.inspect');
assert.equal(
(await request(application, '/api/v3/plugin-packages/management'))
.statusCode,
404,
);
assert.equal(calls.length, 1);
assert.equal(calls.length, 2);
} finally {
await application.close();
}
@@ -312,10 +316,18 @@ test('rejects a CRL-revoked client certificate before OIDC', async () => {
test('maps Worker credential management failures to stable HTTP errors', async () => {
for (const [failure, statusCode, code] of [
[new WorkerCredentialManagementRequestError('invalid'), 400, 'request_invalid'],
[
new WorkerCredentialManagementRequestError('invalid'),
400,
'request_invalid',
],
[new WorkerCredentialManagementAuthorizationError(), 403, 'forbidden'],
[new WorkerCredentialManagementConflictError('conflict'), 409, 'conflict'],
[new WorkerCredentialManagementQuotaExceededError(1_250), 429, 'quota_exceeded'],
[
new WorkerCredentialManagementQuotaExceededError(1_250),
429,
'quota_exceeded',
],
[new WorkerCredentialManagementUnavailableError(), 503, 'unavailable'],
]) {
const application = await start(async () => {
@@ -353,6 +365,34 @@ test('rejects arbitrary management paths at configuration time', async () => {
}
});
test('rejects arbitrary or cross-plane compatible route aliases', async () => {
for (const compatibleManagementPaths of [
['/api/v3/automations/management'],
['/api/v3/worker-credentials/management', '/api/v3/runs/management'],
]) {
const privateKey = Buffer.from(readFileSync(SERVER_KEY));
try {
await assert.rejects(
startClusterPluginPackageManagementHttp({
host: '127.0.0.1',
port: 0,
tls: {
privateKey,
certificate: Buffer.from(readFileSync(SERVER_CERT)),
},
identities: identities(),
transport: { async execute() {} },
managementPath: CANONICAL_WORKER_PATH,
compatibleManagementPaths,
}),
ClusterPluginPackageManagementHttpConfigurationError,
);
} finally {
privateKey.fill(0);
}
}
});
test('accepts both client CAs during overlap then rejects the retired CA', async () => {
const execute = async () => ({
schemaVersion: 1,