feat(ql3): establish 3.0 incubation baseline

2026-09-22 10:32:40 +08:00 · 2026-08-12 00:25:26 +08:00
parent 4bf92dcfeb
commit c699c32461
2817 changed files with 779642 additions and 653 deletions
@@ -0,0 +1,71 @@
+const assert = require('node:assert/strict');
+const { createHmac } = require('node:crypto');
+const { test } = require('node:test');
+const {
+  normalizeWorkerCredentialRecord,
+} = require('@qinglong/runtime-core/worker-credential');
+const {
+  formatWorkerCredentialToken,
+  workerCredentialSecretDigest,
+} = require('@qinglong/runtime-core/worker-credential-token');
+
+const PEPPER = Buffer.alloc(32, 1).toString('base64url');
+const SECRET = Buffer.alloc(32, 2).toString('base64url');
+
+function credential(overrides = {}) {
+  return {
+    credentialId: 'worker_primary',
+    version: 2,
+    state: 'active',
+    workerId: 'edge-router-1',
+    secretDigest: 'a'.repeat(64),
+    createdAtMs: 100,
+    notBeforeAtMs: 100,
+    expiresAtMs: 1_000,
+    ...overrides,
+  };
+}
+
+test('normalizes one immutable Worker credential without secret material', () => {
+  const normalized = normalizeWorkerCredentialRecord(credential());
+  assert.deepEqual(normalized, credential());
+  assert.equal(Object.isFrozen(normalized), true);
+  assert.equal(JSON.stringify(normalized).includes(SECRET), false);
+
+  const preapproved = credential({ notBeforeAtMs: 50 });
+  assert.deepEqual(normalizeWorkerCredentialRecord(preapproved), preapproved);
+});
+
+test('derives a Worker-only digest domain and canonical ql3w token', () => {
+  const expected = createHmac('sha256', Buffer.from(PEPPER, 'base64url'))
+    .update(Buffer.from('qinglong-worker-credential-v1\0', 'utf8'))
+    .update('worker_primary', 'utf8')
+    .update('\0', 'utf8')
+    .update(Buffer.from(SECRET, 'base64url'))
+    .digest('hex');
+  assert.equal(
+    workerCredentialSecretDigest(PEPPER, 'worker_primary', SECRET),
+    expected,
+  );
+  assert.equal(
+    formatWorkerCredentialToken('worker_primary', SECRET),
+    `ql3w_worker_primary_${SECRET}`,
+  );
+});
+
+test('rejects widened records, unsafe identities, weak entropy and lifetimes', () => {
+  for (const value of [
+    { ...credential(), extra: true },
+    credential({ credentialId: '../worker' }),
+    credential({ workerId: '../worker' }),
+    credential({ version: 0 }),
+    credential({ state: 'disabled' }),
+    credential({ secretDigest: 'A'.repeat(64) }),
+    credential({ notBeforeAtMs: -1 }),
+    credential({ expiresAtMs: 100 }),
+  ]) {
+    assert.throws(() => normalizeWorkerCredentialRecord(value));
+  }
+  assert.throws(() => workerCredentialSecretDigest('weak', 'worker_primary', SECRET));
+  assert.throws(() => formatWorkerCredentialToken('worker_primary', 'weak'));
+});