feat(ql3): establish 3.0 incubation baseline

2026-09-20 16:07:11 +08:00 · 2026-08-12 00:25:26 +08:00
parent 4bf92dcfeb
commit c699c32461
2817 changed files with 779642 additions and 653 deletions
@@ -0,0 +1,34 @@
+const assert = require('node:assert/strict');
+const { test } = require('node:test');
+const {
+  InvalidApiCredentialTokenValueError,
+  apiCredentialSecretDigest,
+  assertApiCredentialPepper,
+  formatApiCredentialToken,
+} = require('@qinglong/runtime-core/api-credential-token');
+
+test('derives one domain-separated digest and formats the canonical token', () => {
+  const pepper = Buffer.alloc(32, 1).toString('base64url');
+  const secret = Buffer.alloc(32, 2).toString('base64url');
+  assert.doesNotThrow(() => assertApiCredentialPepper(pepper));
+  assert.equal(
+    apiCredentialSecretDigest(pepper, 'app_primary', secret),
+    'e15b6ff4b2ab5037c149974e6bd788eca4777e4d698f649373d39244555d4991',
+  );
+  assert.equal(
+    formatApiCredentialToken('app_primary', secret),
+    `ql3c_app_primary_${secret}`,
+  );
+});
+
+test('rejects weak, non-canonical and widened token material', () => {
+  const canonical = Buffer.alloc(32, 1).toString('base64url');
+  for (const action of [
+    () => assertApiCredentialPepper('weak'),
+    () => apiCredentialSecretDigest(canonical, '../escape', canonical),
+    () => apiCredentialSecretDigest(canonical, 'valid', `${canonical}=`),
+    () => formatApiCredentialToken('valid', 'weak'),
+  ]) {
+    assert.throws(action, InvalidApiCredentialTokenValueError);
+  }
+});