feat(ql3): establish 3.0 incubation baseline

packages/ql3-cluster-admin/test/workerCredentialManagementExecutor.test.cjs

@@ -0,0 +1,58 @@
+const assert = require('node:assert/strict');
+const { test } = require('node:test');
+
+const {
+  WorkerCredentialManagementRequestError,
+} = require('@qinglong/cluster-admin/worker-credential-management');
+const {
+  runClusterWorkerCredentialExecution,
+} = require('@qinglong/cluster-admin/worker-credential-management-executor');
+
+function options(overrides = {}) {
+  let opens = 0;
+  let sessions = 0;
+  const value = {
+    openDatabase: async () => {
+      opens += 1;
+      throw new Error('database must not open');
+    },
+    tokenRequestSession: {
+      async withDelivery() {
+        sessions += 1;
+        throw new Error('TokenRequest must not start');
+      },
+    },
+    workerCredentialPepper: 'pepper-value',
+    actionRef: 'worker-credential:worker-a:generation-2',
+    approvalRequestId: 'approval-worker-a-generation-2',
+    consumptionId: 'consume-worker-a-generation-2',
+    dispatchId: 'dispatch-worker-a-generation-2',
+    auditEventId: '123e4567-e89b-42d3-a456-426614174705',
+    confirmAuthorization: async () => {
+      throw new Error('operator session expired');
+    },
+    now: () => 1_000,
+    ...overrides,
+  };
+  return { value, opens: () => opens, sessions: () => sessions };
+}
+
+test('fails before PostgreSQL and TokenRequest when caller authorization is absent', async () => {
+  const fixture = options();
+  await assert.rejects(
+    runClusterWorkerCredentialExecution(fixture.value),
+    /operator session expired/,
+  );
+  assert.equal(fixture.opens(), 0);
+  assert.equal(fixture.sessions(), 0);
+});
+
+test('rejects widened executor inputs before acquiring any authority', async () => {
+  const fixture = options({ debug: true });
+  await assert.rejects(
+    runClusterWorkerCredentialExecution(fixture.value),
+    WorkerCredentialManagementRequestError,
+  );
+  assert.equal(fixture.opens(), 0);
+  assert.equal(fixture.sessions(), 0);
+});