feat(ql3): establish 3.0 incubation baseline

2026-09-21 01:32:44 +08:00 · 2026-08-12 00:25:26 +08:00
parent 4bf92dcfeb
commit c699c32461
2817 changed files with 779642 additions and 653 deletions
@@ -0,0 +1,118 @@
+require('ts-node/register/transpile-only');
+
+const assert = require('node:assert/strict');
+const { test } = require('node:test');
+const {
+  Sha256WorkerExecutionCompletionReceiptAuthenticator,
+} = require('../../back/runtime/adapters/crypto/sha256WorkerExecutionCompletionReceiptAuthenticator');
+const {
+  createWorkerExecutionCompletionReceiptAuthentication,
+  matchesWorkerExecutionCompletionReceiptAuthentication,
+} = require('../../back/runtime/domain/workerExecutionCompletionReceiptAuthentication');
+
+const TOKEN = 'worker_receipt_capability_abcdefghijklmnopqrstuvwxyz01';
+
+function receipt(overrides = {}) {
+  return {
+    schemaVersion: 1,
+    runId: '019f8200-0000-7000-8000-000000000001',
+    attemptId: '019f8200-0000-7000-8000-000000000002',
+    callbackSequence: 1,
+    token: TOKEN,
+    startedAtMs: 10,
+    finishedAtMs: 20,
+    exitCode: 0,
+    ...overrides,
+  };
+}
+
+test('derives only a bounded SHA-256 digest from the ephemeral callback', () => {
+  assert.equal(
+    createWorkerExecutionCompletionReceiptAuthentication(undefined),
+    undefined,
+  );
+  const authentication = createWorkerExecutionCompletionReceiptAuthentication({
+    token: TOKEN,
+    callbackSequence: 1,
+  });
+  assert.deepEqual(Object.keys(authentication).sort(), [
+    'callbackSequence',
+    'tokenDigest',
+  ]);
+  assert.match(authentication.tokenDigest, /^[0-9a-f]{64}$/);
+  assert.doesNotMatch(JSON.stringify(authentication), new RegExp(TOKEN));
+});
+
+test('matches token and callback sequence without accepting partial authority', () => {
+  const expected = createWorkerExecutionCompletionReceiptAuthentication({
+    token: TOKEN,
+    callbackSequence: 1,
+  });
+  assert.equal(
+    matchesWorkerExecutionCompletionReceiptAuthentication(receipt(), expected),
+    true,
+  );
+  assert.equal(
+    matchesWorkerExecutionCompletionReceiptAuthentication(
+      receipt({ token: `${TOKEN}x` }),
+      expected,
+    ),
+    false,
+  );
+  assert.equal(
+    matchesWorkerExecutionCompletionReceiptAuthentication(
+      receipt({ callbackSequence: 2 }),
+      expected,
+    ),
+    false,
+  );
+  assert.equal(
+    matchesWorkerExecutionCompletionReceiptAuthentication(receipt(), {
+      ...expected,
+      tokenDigest: 'A'.repeat(64),
+    }),
+    false,
+  );
+});
+
+test('adapter refuses records without both persisted authentication fields', () => {
+  const authenticator =
+    new Sha256WorkerExecutionCompletionReceiptAuthenticator();
+  const expected = createWorkerExecutionCompletionReceiptAuthentication({
+    token: TOKEN,
+    callbackSequence: 1,
+  });
+  assert.equal(authenticator.authenticate(receipt(), {}), false);
+  assert.equal(
+    authenticator.authenticate(receipt(), {
+      completionReceiptCallbackSequence: expected.callbackSequence,
+    }),
+    false,
+  );
+  assert.equal(
+    authenticator.authenticate(receipt(), {
+      completionReceiptCallbackSequence: expected.callbackSequence,
+      completionReceiptTokenDigest: expected.tokenDigest,
+    }),
+    true,
+  );
+});
+
+test('rejects malformed callback capability before it can be persisted', () => {
+  assert.throws(
+    () =>
+      createWorkerExecutionCompletionReceiptAuthentication({
+        token: 'short',
+        callbackSequence: 1,
+      }),
+    /token is invalid/,
+  );
+  assert.throws(
+    () =>
+      createWorkerExecutionCompletionReceiptAuthentication({
+        token: TOKEN,
+        callbackSequence: 0,
+      }),
+    /positive safe integer/,
+  );
+});