feat(ql3): establish 3.0 incubation baseline

2026-09-22 19:29:13 +08:00 · 2026-08-12 00:25:26 +08:00
parent 4bf92dcfeb
commit c699c32461
2817 changed files with 779642 additions and 653 deletions
@@ -0,0 +1,104 @@
+const assert = require('node:assert/strict');
+const { test } = require('node:test');
+const {
+  WorkerCredentialUnavailableError,
+} = require('@qinglong/runtime-core/worker-credential');
+const {
+  workerCredentialSecretDigest,
+} = require('@qinglong/runtime-core/worker-credential-token');
+const {
+  createWorkerCredentialAuthenticator,
+} = require('@qinglong/cluster-control/worker-ingress');
+
+const NOW = 10_000;
+const PEPPER = Buffer.alloc(32, 1).toString('base64url');
+const SECRET = Buffer.alloc(32, 2).toString('base64url');
+const CREDENTIAL_ID = 'worker_primary';
+
+function metadata(authorization = `Worker ql3w_${CREDENTIAL_ID}_${SECRET}`) {
+  return {
+    requestId: 'request-1',
+    method: 'POST',
+    path: '/api/v3/worker-ingress/workers/edge-1/sessions/018f5c64-9b9d-7f1a-8c2d-1234567890ac/heartbeat',
+    query: Object.freeze({}),
+    headers: Object.freeze({ authorization }),
+    signal: new AbortController().signal,
+  };
+}
+
+function credential(overrides = {}) {
+  return {
+    credentialId: CREDENTIAL_ID,
+    version: 2,
+    state: 'active',
+    workerId: 'edge-1',
+    secretDigest: workerCredentialSecretDigest(PEPPER, CREDENTIAL_ID, SECRET),
+    createdAtMs: 1,
+    notBeforeAtMs: 1,
+    expiresAtMs: 100_000,
+    ...overrides,
+  };
+}
+
+function authenticator(value = credential(), overrides = {}) {
+  return createWorkerCredentialAuthenticator(
+    { async resolve(id) { assert.equal(id, CREDENTIAL_ID); return value; } },
+    PEPPER,
+    { now: () => NOW, ...overrides },
+  );
+}
+
+test('authenticates a ql3w credential as its bound short-lived Worker', async () => {
+  assert.deepEqual(await authenticator().authenticate(metadata()), {
+    workerId: 'edge-1',
+    credentialId: CREDENTIAL_ID,
+    credentialVersion: 2,
+    authenticationId: `worker_credential:${CREDENTIAL_ID}:2`,
+    authenticatedAtMs: NOW,
+    expiresAtMs: 70_000,
+  });
+});
+
+test('rejects malformed, mismatched, inactive and expired Worker credentials', async () => {
+  let calls = 0;
+  const strict = createWorkerCredentialAuthenticator(
+    { async resolve() { calls += 1; return credential(); } },
+    PEPPER,
+    { now: () => NOW },
+  );
+  for (const authorization of [
+    undefined,
+    'Bearer ql3w_worker_primary_invalid',
+    `Worker ql3w_${CREDENTIAL_ID}_${Buffer.alloc(32, 3).toString('base64url')}`,
+  ]) {
+    const request = metadata();
+    request.headers = Object.freeze(authorization ? { authorization } : {});
+    assert.equal(await strict.authenticate(request), null);
+  }
+  assert.equal(calls, 1);
+  for (const value of [
+    null,
+    credential({ state: 'revoked' }),
+    credential({ notBeforeAtMs: NOW + 1 }),
+    credential({ expiresAtMs: NOW }),
+  ]) assert.equal(await authenticator(value).authenticate(metadata()), null);
+});
+
+test('maps storage, corrupt records and cancellation to unavailable', async () => {
+  const unavailable = createWorkerCredentialAuthenticator(
+    { async resolve() { throw new Error('database unavailable'); } },
+    PEPPER,
+    { now: () => NOW },
+  );
+  await assert.rejects(unavailable.authenticate(metadata()), WorkerCredentialUnavailableError);
+  await assert.rejects(
+    authenticator(credential({ secretDigest: 'corrupt' })).authenticate(metadata()),
+    WorkerCredentialUnavailableError,
+  );
+  const controller = new AbortController();
+  controller.abort();
+  await assert.rejects(
+    authenticator().authenticate({ ...metadata(), signal: controller.signal }),
+    WorkerCredentialUnavailableError,
+  );
+});