feat(ql3): establish 3.0 incubation baseline

2026-09-21 09:58:46 +08:00 · 2026-08-12 00:25:26 +08:00
parent 4bf92dcfeb
commit c699c32461
2817 changed files with 779642 additions and 653 deletions
@@ -0,0 +1,128 @@
+import type {
+  OpenPostgresDatabase,
+  PostgresDatabaseResource,
+} from '@qinglong/runtime-core';
+import { assertApiCredentialPepper } from '@qinglong/runtime-core/api-credential-token';
+import { assertWorkerCredentialPepper } from '@qinglong/runtime-core/worker-credential-token';
+import type { SecurityAuditQueryRepository } from '@qinglong/runtime-core/security-audit-query';
+import {
+  PostgresApiCredentialAdministrationRepository,
+  PostgresIdentityAdministrationRepository,
+  PostgresSecurityAuditQueryRepository,
+  PostgresWorkerCredentialAdministrationRepository,
+  assertPostgresAdminSchemaReady,
+  type PostgresSchemaReadinessReport,
+} from '@qinglong/cluster-postgres/admin';
+import {
+  createClusterAdministrationService,
+  type ClusterAdministrationOptions,
+  type ClusterAdministrationService,
+} from '../security-administration/clusterAdministration';
+import {
+  createWorkerCredentialAdministrationService,
+  type WorkerCredentialAdministrationService,
+} from '../worker-credential/workerCredentialAdministration';
+
+export interface ClusterAdminBootstrapOptions
+  extends ClusterAdministrationOptions {
+  readonly openDatabase: OpenPostgresDatabase;
+  readonly apiCredentialPepper: string;
+  readonly workerCredentialPepper: string;
+}
+
+export interface ClusterAdminRuntime {
+  readonly evidence: PostgresSchemaReadinessReport;
+  readonly administration: ClusterAdministrationService;
+  readonly audit: SecurityAuditQueryRepository;
+  readonly workerCredentials: WorkerCredentialAdministrationService;
+  close(): Promise<void>;
+}
+
+export async function bootstrapClusterAdmin(
+  options: ClusterAdminBootstrapOptions,
+): Promise<ClusterAdminRuntime> {
+  if (!options || typeof options !== 'object' || Array.isArray(options)) {
+    throw new TypeError('Cluster admin bootstrap options are invalid');
+  }
+  if (typeof options.openDatabase !== 'function') {
+    throw new TypeError('Cluster admin database opener is invalid');
+  }
+  const optionKeys = new Set([
+    'openDatabase',
+    'apiCredentialPepper',
+    'workerCredentialPepper',
+    'now',
+    'randomBytes',
+  ]);
+  if (Object.keys(options).some((key) => !optionKeys.has(key))) {
+    throw new TypeError('Cluster admin bootstrap options shape is invalid');
+  }
+  if (options.now !== undefined && typeof options.now !== 'function') {
+    throw new TypeError('Cluster admin clock is invalid');
+  }
+  if (
+    options.randomBytes !== undefined &&
+    typeof options.randomBytes !== 'function'
+  ) {
+    throw new TypeError('Cluster admin random source is invalid');
+  }
+  try {
+    assertApiCredentialPepper(options.apiCredentialPepper);
+  } catch {
+    throw new TypeError('Cluster admin API credential pepper is invalid');
+  }
+  try {
+    assertWorkerCredentialPepper(options.workerCredentialPepper);
+  } catch {
+    throw new TypeError('Cluster admin Worker credential pepper is invalid');
+  }
+  let database: PostgresDatabaseResource | undefined;
+  let closePromise: Promise<void> | undefined;
+  const close = (): Promise<void> => {
+    if (!database) return Promise.resolve();
+    closePromise ??= database.close();
+    return closePromise;
+  };
+  try {
+    database = await options.openDatabase();
+    const evidence = await assertPostgresAdminSchemaReady(database.pool);
+    const identities = new PostgresIdentityAdministrationRepository(
+      database.pool,
+    );
+    const credentials = new PostgresApiCredentialAdministrationRepository(
+      database.pool,
+    );
+    return Object.freeze({
+      evidence,
+      administration: createClusterAdministrationService(
+        identities,
+        credentials,
+        options.apiCredentialPepper,
+        {
+          ...(options.now ? { now: options.now } : {}),
+          ...(options.randomBytes ? { randomBytes: options.randomBytes } : {}),
+        },
+      ),
+      audit: new PostgresSecurityAuditQueryRepository(database.pool),
+      workerCredentials: createWorkerCredentialAdministrationService(
+        new PostgresWorkerCredentialAdministrationRepository(database.pool),
+        options.workerCredentialPepper,
+        {
+          ...(options.now ? { now: options.now } : {}),
+          ...(options.randomBytes ? { randomBytes: options.randomBytes } : {}),
+        },
+      ),
+      close,
+    });
+  } catch (error) {
+    try {
+      await close();
+    } catch {
+      // Preserve configuration/readiness/assembly failure.
+    }
+    throw error;
+  }
+}
+
+export * from '../security-administration/clusterAdministration';
+export * from '../worker-credential/workerCredentialAdministration';