feat(ql3): establish 3.0 incubation baseline

2026-09-21 18:08:20 +08:00 · 2026-08-12 00:25:26 +08:00
parent 4bf92dcfeb
commit c699c32461
2817 changed files with 779642 additions and 653 deletions
@@ -0,0 +1,150 @@
+const assert = require('node:assert/strict');
+const { test } = require('node:test');
+
+const {
+  CLUSTER_CONTROL_TASK_READ_ROUTE,
+  createClusterControlTaskReadRoute,
+} = require('@qinglong/cluster-control/task-routes');
+const {
+  createClusterControlAdmissionPipeline,
+} = require('@qinglong/cluster-control/admission');
+const {
+  createClusterControlRouteRegistry,
+} = require('@qinglong/cluster-control/routes');
+const {
+  createTaskDefinitionRecord,
+} = require('@qinglong/runtime-core/task-definition');
+
+function task(overrides = {}) {
+  return createTaskDefinitionRecord(
+    {
+      projectId: 'prj_default',
+      taskId: 'task-a',
+      expectedRevision: null,
+      mutationId: '123e4567-e89b-42d3-a456-426614174201',
+      name: 'Task A',
+      description: 'secret-adjacent',
+      kind: 'command',
+      spec: {
+        schema: 'qinglong/command@v1',
+        config: { command: { kind: 'shell', command: 'private' } },
+      },
+      labels: { private: 'value' },
+      enabled: true,
+      occurredAtMs: 20,
+      ...overrides,
+    },
+    10,
+  );
+}
+
+function authorized(body = null, query = {}) {
+  return {
+    projectId: 'prj_default',
+    request: { body, query },
+  };
+}
+
+test('publishes one reviewed current Task route', () => {
+  assert.deepEqual(CLUSTER_CONTROL_TASK_READ_ROUTE, {
+    method: 'GET',
+    path: '/api/v3/projects/{projectId}/tasks/{taskId}',
+    operationId: 'task.get',
+    permission: 'task.read',
+    projectParameter: 'projectId',
+  });
+  assert.throws(() => createClusterControlTaskReadRoute({}), TypeError);
+});
+
+test('returns the shared projection and masks absent or cross-Project Tasks', async () => {
+  const definition = task({ enabled: false });
+  const calls = [];
+  const route = createClusterControlTaskReadRoute({
+    async findCurrentTaskDefinition(projectId, taskId) {
+      calls.push([projectId, taskId]);
+      return taskId === 'task-a' ? definition : null;
+    },
+  });
+  const result = await route.handle(authorized(), { taskId: 'task-a' });
+  assert.deepEqual(calls, [['prj_default', 'task-a']]);
+  assert.equal(result.statusCode, 200);
+  assert.deepEqual(result.body.task, {
+    taskId: 'task-a',
+    revision: 1,
+    name: 'Task A',
+    kind: 'command',
+    specSchema: 'qinglong/command@v1',
+    enabled: false,
+    contentDigest: definition.contentDigest,
+    createdAtMs: 10,
+    updatedAtMs: 20,
+  });
+  assert.equal(JSON.stringify(result).includes('private'), false);
+  assert.deepEqual(
+    await route.handle(authorized(), { taskId: 'task-absent' }),
+    { statusCode: 404, body: { code: 'task_not_found' } },
+  );
+  const crossProject = createClusterControlTaskReadRoute({
+    async findCurrentTaskDefinition() { return task({ projectId: 'other' }); },
+  });
+  assert.deepEqual(
+    await crossProject.handle(authorized(), { taskId: 'task-a' }),
+    { statusCode: 404, body: { code: 'task_not_found' } },
+  );
+});
+
+test('rejects body and fails closed on corrupt or unavailable storage', async () => {
+  const definition = task();
+  const corrupt = createClusterControlTaskReadRoute({
+    async findCurrentTaskDefinition() {
+      return { ...definition, contentDigest: '0'.repeat(64) };
+    },
+  });
+  assert.deepEqual(
+    await corrupt.handle(authorized(), { taskId: 'task-a' }),
+    { statusCode: 503, body: { code: 'task_query_unavailable' } },
+  );
+  assert.deepEqual(
+    await corrupt.handle(authorized({ invalid: true }), { taskId: 'task-a' }),
+    { statusCode: 400, body: { code: 'invalid_request_body' } },
+  );
+  const unavailable = createClusterControlTaskReadRoute({
+    async findCurrentTaskDefinition() { throw new Error('offline'); },
+  });
+  assert.deepEqual(
+    await unavailable.handle(authorized(), { taskId: 'task-a' }),
+    { statusCode: 503, body: { code: 'task_query_unavailable' } },
+  );
+});
+
+test('rejects query before authentication', async () => {
+  let authentications = 0;
+  const pipeline = createClusterControlAdmissionPipeline({
+    routes: createClusterControlRouteRegistry([
+      createClusterControlTaskReadRoute({
+        async findCurrentTaskDefinition() { return null; },
+      }),
+    ]),
+    authenticator: {
+      authenticate() {
+        authentications += 1;
+        return null;
+      },
+    },
+    policy: { authorize() { throw new Error('must not authorize'); } },
+    audit: { record() { throw new Error('must not audit'); } },
+    now: () => 10_000,
+  });
+  await assert.rejects(
+    pipeline.prepare({
+      requestId: 'request-invalid-task-get',
+      method: 'GET',
+      path: '/api/v3/projects/prj_default/tasks/task-a',
+      query: { expanded: ['true'] },
+      headers: {},
+      signal: new AbortController().signal,
+    }),
+    (error) => error.statusCode === 400 && error.code === 'invalid_route_query',
+  );
+  assert.equal(authentications, 0);
+});