feat(ql3): establish 3.0 incubation baseline

2026-09-20 16:07:11 +08:00 · 2026-08-12 00:25:26 +08:00
parent 4bf92dcfeb
commit c699c32461
2817 changed files with 779642 additions and 653 deletions
@@ -0,0 +1,82 @@
+const assert = require('node:assert/strict');
+const { test } = require('node:test');
+const {
+  ApiCredentialUnavailableError,
+  InvalidApiCredentialValueError,
+} = require('@qinglong/runtime-core/api-credential');
+const {
+  PostgresApiCredentialRepository,
+} = require('@qinglong/cluster-postgres/runtime');
+
+function row(overrides = {}) {
+  return {
+    credentialId: 'app_primary',
+    version: '2',
+    state: 'active',
+    subjectType: 'api_app',
+    subjectId: 'app_primary',
+    subjectStatus: 'active',
+    pepperKeyId: 'legacy-v1',
+    secretDigest: 'a'.repeat(64),
+    createdAtMs: '100',
+    notBeforeAtMs: '100',
+    expiresAtMs: '1000',
+    ...overrides,
+  };
+}
+
+test('resolves only the latest normalized credential and stable subject', async () => {
+  const calls = [];
+  const repository = new PostgresApiCredentialRepository({
+    async query(sql, values) {
+      calls.push({ sql, values });
+      return { rows: [row()] };
+    },
+  });
+  assert.deepEqual(await repository.resolve('app_primary'), {
+    credentialId: 'app_primary',
+    version: 2,
+    pepperKeyId: 'legacy-v1',
+    state: 'active',
+    subject: { type: 'api_app', id: 'app_primary' },
+    subjectStatus: 'active',
+    secretDigest: 'a'.repeat(64),
+    createdAtMs: 100,
+    notBeforeAtMs: 100,
+    expiresAtMs: 1000,
+  });
+  assert.deepEqual(calls[0].values, ['app_primary']);
+  assert.match(calls[0].sql, /ORDER BY credential\.version DESC/);
+  assert.match(calls[0].sql, /identity_subjects/);
+});
+
+test('returns null for unknown credentials and rejects invalid ids before SQL', async () => {
+  let calls = 0;
+  const repository = new PostgresApiCredentialRepository({
+    async query() {
+      calls += 1;
+      return { rows: [] };
+    },
+  });
+  assert.equal(await repository.resolve('unknown'), null);
+  await assert.rejects(
+    repository.resolve('../escape'),
+    InvalidApiCredentialValueError,
+  );
+  assert.equal(calls, 1);
+});
+
+test('fails closed on corrupt rows and database errors', async () => {
+  for (const query of [
+    async () => ({ rows: [row({ secretDigest: 'corrupt' })] }),
+    async () => {
+      throw new Error('driver detail');
+    },
+  ]) {
+    const repository = new PostgresApiCredentialRepository({ query });
+    await assert.rejects(
+      repository.resolve('app_primary'),
+      ApiCredentialUnavailableError,
+    );
+  }
+});