feat(ql3): establish 3.0 incubation baseline

2026-09-22 10:32:40 +08:00 · 2026-08-12 00:25:26 +08:00
parent 4bf92dcfeb
commit c699c32461
2817 changed files with 779642 additions and 653 deletions
@@ -0,0 +1,105 @@
+const assert = require('node:assert/strict');
+const {
+  mkdtemp,
+  mkdir,
+  chmod,
+  symlink,
+  unlink,
+  writeFile,
+} = require('node:fs/promises');
+const { tmpdir } = require('node:os');
+const { join } = require('node:path');
+const test = require('node:test');
+
+const {
+  ProjectedModelProviderSecretMaterialUnavailableError,
+  createProjectedModelProviderSecretMaterialProvider,
+  projectedModelProviderSecretFileName,
+} = require('../dist/model-provider-credential/projectedModelProviderSecretMaterial.js');
+const { createSecretRef } = require('@qinglong/runtime-core/secret-reference');
+
+const SECRET_REF = createSecretRef({
+  projectId: 'project-a',
+  name: 'openai-token',
+});
+
+async function generation(root, name, value, mode = 0o440) {
+  const directory = join(root, name);
+  await mkdir(directory);
+  const path = join(
+    directory,
+    projectedModelProviderSecretFileName(SECRET_REF),
+  );
+  await writeFile(path, value, { mode });
+  await chmod(path, mode);
+}
+
+async function atomicProjection(root, activeGeneration) {
+  const fileName = projectedModelProviderSecretFileName(SECRET_REF);
+  await symlink(activeGeneration, join(root, '..data'));
+  await symlink(join('..data', fileName), join(root, fileName));
+}
+
+test('projected credential material follows atomic rotation and wipes owned bytes', async () => {
+  const root = await mkdtemp(join(tmpdir(), 'ql3-ai-credential-'));
+  await generation(root, '..data-one', 'token-one');
+  await generation(root, '..data-two', 'token-two');
+  await atomicProjection(root, '..data-one');
+  const provider = await createProjectedModelProviderSecretMaterialProvider({
+    rootDirectory: root,
+  });
+
+  const first = await provider.resolveProjectSecretMaterial({
+    projectId: 'project-a',
+    secretRef: SECRET_REF,
+  });
+  assert.equal(Buffer.from(first.bytes).toString('utf8'), 'token-one');
+  const owned = first.bytes;
+  await first.dispose();
+  assert.deepEqual([...owned], Array(9).fill(0));
+
+  await unlink(join(root, '..data'));
+  await symlink('..data-two', join(root, '..data'));
+  const second = await provider.resolveProjectSecretMaterial({
+    projectId: 'project-a',
+    secretRef: SECRET_REF,
+  });
+  assert.equal(Buffer.from(second.bytes).toString('utf8'), 'token-two');
+  await second.dispose();
+});
+
+test('projected credential material rejects Project drift and writable material', async () => {
+  const root = await mkdtemp(join(tmpdir(), 'ql3-ai-credential-'));
+  await generation(root, '..data-one', 'unsafe-token', 0o640);
+  await atomicProjection(root, '..data-one');
+  const provider = await createProjectedModelProviderSecretMaterialProvider({
+    rootDirectory: root,
+  });
+  await assert.rejects(
+    provider.resolveProjectSecretMaterial({
+      projectId: 'project-b',
+      secretRef: SECRET_REF,
+    }),
+    ProjectedModelProviderSecretMaterialUnavailableError,
+  );
+  await assert.rejects(
+    provider.resolveProjectSecretMaterial({
+      projectId: 'project-a',
+      secretRef: SECRET_REF,
+    }),
+    ProjectedModelProviderSecretMaterialUnavailableError,
+  );
+});
+
+test('projected credential material rejects symlink root', async () => {
+  const direct = await mkdtemp(join(tmpdir(), 'ql3-ai-credential-'));
+  const parent = await mkdtemp(join(tmpdir(), 'ql3-ai-credential-link-'));
+  const linked = join(parent, 'root');
+  await symlink(direct, linked);
+  await assert.rejects(
+    createProjectedModelProviderSecretMaterialProvider({
+      rootDirectory: linked,
+    }),
+    ProjectedModelProviderSecretMaterialUnavailableError,
+  );
+});