feat(ql3): establish 3.0 incubation baseline

2026-09-23 12:05:27 +08:00 · 2026-08-12 00:25:26 +08:00
parent 4bf92dcfeb
commit c699c32461
2817 changed files with 779642 additions and 653 deletions
@@ -0,0 +1,83 @@
+const assert = require('node:assert/strict');
+const { readFileSync } = require('node:fs');
+const path = require('node:path');
+const { test } = require('node:test');
+const {
+  startClusterWorkerIngressApplication,
+} = require('@qinglong/cluster-control/worker-ingress');
+
+const FIXTURES = path.join(__dirname, 'fixtures', 'mtls');
+const MUTUAL_TLS = Object.freeze({
+  privateKey: readFileSync(path.join(FIXTURES, 'server-key.pem')),
+  certificateChain: readFileSync(path.join(FIXTURES, 'server-cert.pem')),
+  clientCertificateAuthorities: Object.freeze([
+    readFileSync(path.join(FIXTURES, 'ca-cert.pem')),
+  ]),
+});
+const EVIDENCE = Object.freeze({
+  contractName: 'control-core',
+  contractVersion: 14,
+  serverMajor: 16,
+  migrationIds: Object.freeze([]),
+});
+
+test('enabled Worker ingress rejects plaintext before binding or opening storage', async () => {
+  let databaseOpens = 0;
+  await assert.rejects(
+    startClusterWorkerIngressApplication({
+      enabled: true,
+      profile: 'cluster-control',
+      workerCredentialPepper: 'A'.repeat(43),
+      openDatabase: async () => {
+        databaseOpens += 1;
+        throw new Error('must not open');
+      },
+      create() {
+        throw new Error('must not assemble');
+      },
+      http: { host: '127.0.0.1', port: 0 },
+    }),
+    /requires mutual TLS/,
+  );
+  assert.equal(databaseOpens, 0);
+});
+
+test('exposes explicit transport reload only for an active mTLS ingress', async (t) => {
+  let databaseCloses = 0;
+  const application = await startClusterWorkerIngressApplication({
+    enabled: true,
+    profile: 'cluster-control',
+    workerCredentialPepper: 'A'.repeat(43),
+    openDatabase: async () => ({
+      client: {},
+      async close() {
+        databaseCloses += 1;
+      },
+    }),
+    create() {
+      return {
+        evidence: EVIDENCE,
+        pipeline: {
+          async prepare() {
+            return {
+              handle() {
+                return { statusCode: 204 };
+              },
+            };
+          },
+        },
+      };
+    },
+    http: {
+      host: '127.0.0.1',
+      port: 0,
+      mutualTls: MUTUAL_TLS,
+    },
+  });
+  t.after(() => application.stop());
+
+  assert.equal(application.status, 'active');
+  assert.equal(application.reloadTransport(MUTUAL_TLS), 2);
+  assert.equal(await application.stop(), 'stopped');
+  assert.equal(databaseCloses, 1);
+});