feat(ql3): add secure console cron scheduling

packages/ql3-local-api/src/task/taskPutRoute.ts

@@ -14,7 +14,6 @@ import {
 } from '@qinglong/runtime-core/project-policy';
 import {
   normalizeSecurityPolicyDecision,
-  normalizeSecurityPrincipal,
   type SecurityPolicyDecision,
 } from '@qinglong/runtime-core/security';
 import {
@@ -38,6 +37,7 @@ import {
 } from '@qinglong/runtime-core/task-definition-administration';
 
 import type { AuthenticatedLocalApiRequest } from '../authentication/credentialAuthenticator';
+import { strongLocalConsolePrincipal } from '../authentication/strongLocalPrincipal';
 import {
   LocalPresenceProofUnavailableError,
   type LocalPresenceBinding,
@@ -491,18 +491,9 @@ export function createLocalApiTaskPutRoute(
       }
       let strongPrincipal;
       try {
-        strongPrincipal = normalizeSecurityPrincipal(
-          {
-            subject: request.authenticated.principal.subject,
-            authenticationId: `local_presence:${proof.authorizationId}`,
-            authenticatedAtMs: proof.authenticatedAtMs,
-            expiresAtMs: Math.min(
-              proof.expiresAtMs,
-              request.authenticated.principal.expiresAtMs,
-            ),
-            assurance: 'local_console',
-          },
-          proof.authenticatedAtMs,
+        strongPrincipal = strongLocalConsolePrincipal(
+          request.authenticated,
+          proof,
         );
       } catch {
         return response(503, { code: 'authentication_unavailable' });