feat(ql3): establish 3.0 incubation baseline

2026-09-20 16:07:11 +08:00 · 2026-08-12 00:25:26 +08:00
parent 4bf92dcfeb
commit c699c32461
2817 changed files with 779642 additions and 653 deletions
@@ -0,0 +1,45 @@
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const test = require('node:test');
+
+const {
+  auditProviderCredentialManagementDeployment,
+} = require('../../scripts/ql3-provider-credential-management-deployment-audit.cjs');
+
+const ROOT = path.resolve(__dirname, '../..');
+
+test('provider credential management deployment is opt-in and least privilege', () => {
+  const report = auditProviderCredentialManagementDeployment({ root: ROOT });
+  assert.deepEqual(report.findings, []);
+  assert.equal(report.compatible, true);
+  assert.equal(report.manager, 'optional-tls13-mtls-oidc-https');
+  assert.equal(report.client, 'caller-driven-one-shot');
+  assert.equal(report.postgresAuthority, 'ql3_ai_credential_manager');
+});
+
+test('provider credential management deployment audit rejects widened database pools', () => {
+  const target = path.join(
+    ROOT,
+    'deploy/kubernetes/ql3-cluster/operations/provider-credential-management/base/deployment.yaml',
+  );
+  const readFile = (filePath, encoding) => {
+    const source = fs.readFileSync(filePath, encoding);
+    return path.resolve(filePath) === target
+      ? source.replace(
+          "QL3_POSTGRES_AI_CREDENTIAL_MANAGER_POOL_MAX\n              value: '2'",
+          "QL3_POSTGRES_AI_CREDENTIAL_MANAGER_POOL_MAX\n              value: '20'",
+        )
+      : source;
+  };
+  const report = auditProviderCredentialManagementDeployment({
+    root: ROOT,
+    readFile,
+  });
+  assert.equal(report.compatible, false);
+  assert.ok(
+    report.findings.some(
+      ({ code }) => code === 'QL3_PROVIDER_CREDENTIAL_MANAGEMENT_ENV_INVALID',
+    ),
+  );
+});