feat(ql3): add strong cluster run management

2026-09-23 03:18:09 +08:00 · 2026-08-12 07:28:43 +08:00
parent e38b143dbb
commit c0ab62e64a
58 changed files with 3087 additions and 105 deletions
@@ -0,0 +1,108 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const { readFileSync } = require('node:fs');
+const { request: httpsRequest } = require('node:https');
+const { resolve } = require('node:path');
+const { test } = require('node:test');
+
+const {
+  ClusterRunManagementRateLimitedError,
+} = require('@qinglong/cluster-admin/run-management');
+const {
+  startClusterRunManagementHttp,
+} = require('@qinglong/cluster-admin/run-management-http');
+
+const SERVER_KEY = resolve(__dirname, '../../ql3-cluster-control/test/fixtures/mtls/server-key.pem');
+const SERVER_CERT = resolve(__dirname, '../../ql3-cluster-control/test/fixtures/mtls/server-cert.pem');
+const PATH = '/api/v3/runs/management';
+
+function post(port, path = PATH) {
+  const body = Buffer.from(JSON.stringify({
+    schemaVersion: 1,
+    operation: 'run.retry',
+    request: {
+      projectId: 'project-1',
+      sourceRunId: 'source-run-1',
+      requestId: 'request-1',
+      auditEventId: '019f9600-0000-4000-8000-000000000001',
+      failureAuditEventId: '019f9600-0000-4000-8000-000000000002',
+      body: {
+        schema: 'qinglong/run-manual-retry@v1',
+        mutationId: '019f9600-0000-4000-8000-000000000003',
+        expectedRunVersion: 7,
+        expectedRunStatus: 'failed',
+      },
+    },
+  }));
+  return new Promise((resolvePromise, reject) => {
+    const outgoing = httpsRequest({
+      host: '127.0.0.1',
+      port,
+      path,
+      method: 'POST',
+      rejectUnauthorized: false,
+      agent: false,
+      headers: {
+        authorization: 'Bearer assertion',
+        'content-type': 'application/json',
+        'content-length': String(body.length),
+      },
+    }, (incoming) => {
+      const chunks = [];
+      incoming.on('data', (chunk) => chunks.push(chunk));
+      incoming.once('end', () => {
+        const bytes = Buffer.concat(chunks);
+        resolvePromise({
+          statusCode: incoming.statusCode,
+          headers: incoming.headers,
+          body: bytes.length ? JSON.parse(bytes.toString('utf8')) : null,
+        });
+      });
+    });
+    outgoing.once('error', reject);
+    outgoing.end(body);
+  });
+}
+
+test('serves only the Run path and maps durable quota to bounded HTTP facts', async () => {
+  const application = await startClusterRunManagementHttp({
+    host: '127.0.0.1',
+    port: 0,
+    tls: {
+      privateKey: Buffer.from(readFileSync(SERVER_KEY)),
+      certificate: Buffer.from(readFileSync(SERVER_CERT)),
+    },
+    identities: {
+      async reload() { throw new Error('not used'); },
+      bind() {
+        return { authenticate: async () => ({
+          subject: { type: 'user', id: 'operator-1' },
+          authenticationId: 'oidc:run-management-1',
+          authenticatedAtMs: 900,
+          expiresAtMs: 10_000,
+          assurance: 'hardware',
+        }) };
+      },
+    },
+    transport: {
+      async execute(_command, authentication) {
+        await authentication.authenticate();
+        throw new ClusterRunManagementRateLimitedError(1_500);
+      },
+    },
+    now: () => 1_000,
+  });
+  try {
+    const limited = await post(application.address.port);
+    assert.equal(limited.statusCode, 429);
+    assert.equal(limited.headers['retry-after'], '2');
+    assert.equal(limited.body.error.code, 'rate_limited');
+    assert.match(limited.body.requestId, /^[0-9a-f-]{36}$/);
+    const absent = await post(application.address.port, '/api/v3/approvals/management');
+    assert.equal(absent.statusCode, 404);
+    assert.equal(absent.body.error.code, 'not_found');
+  } finally {
+    await application.close();
+  }
+});