mirror of
https://github.com/whyour/qinglong.git
synced 2026-09-22 19:29:13 +08:00
feat(ql3): separate cluster secret transition authority
This commit is contained in:
whyour
@@ -186,6 +186,8 @@ function database(serverVersionNum = '160014') {
|
||||
'plugin_package_workflow_task_attempt_snapshot',
|
||||
'register_plugin_package_automation_disposition_event',
|
||||
'create_plugin_package_secret_binding_approval_plan',
|
||||
'create_plugin_package_secret_transition_plan',
|
||||
'plugin_package_secret_binding_transition_snapshot',
|
||||
].includes(functionName),
|
||||
isOwner: false,
|
||||
})),
|
||||
|
||||
@@ -240,6 +240,47 @@ function commands() {
|
||||
inspectionId: 'inspection-secret-binding-1',
|
||||
},
|
||||
},
|
||||
{
|
||||
schemaVersion: 1,
|
||||
operation: 'plugin-package.secret-binding.transition.plan',
|
||||
request: {
|
||||
actionRef: 'secret-transition:cluster-monitor:2',
|
||||
projectId: 'project-1',
|
||||
packageName: 'cluster-monitor',
|
||||
assignments: [{
|
||||
name: 'TOKEN',
|
||||
secretRef:
|
||||
'qlsecret:v1:eyJwcm9qZWN0SWQiOiJwcm9qZWN0LTEiLCJuYW1lIjoicnVudGltZS10b2tlbiIsInZlcnNpb24iOjJ9',
|
||||
}],
|
||||
},
|
||||
},
|
||||
{
|
||||
schemaVersion: 1,
|
||||
operation: 'plugin-package.secret-binding.transition.propose',
|
||||
request: {
|
||||
actionRef: 'secret-transition:cluster-monitor:2',
|
||||
approvalRequestId: 'approval-secret-transition-1',
|
||||
approvalAuditEventId: 'audit-secret-transition-approval-1',
|
||||
},
|
||||
},
|
||||
{
|
||||
schemaVersion: 1,
|
||||
operation: 'plugin-package.secret-binding.transition.decide',
|
||||
request: {
|
||||
...decision,
|
||||
actionRef: 'secret-transition:cluster-monitor:2',
|
||||
approvalRequestId: 'approval-secret-transition-1',
|
||||
},
|
||||
},
|
||||
{
|
||||
schemaVersion: 1,
|
||||
operation: 'plugin-package.secret-binding.transition.inspect',
|
||||
request: {
|
||||
actionRef: 'secret-transition:cluster-monitor:2',
|
||||
approvalRequestId: 'approval-secret-transition-1',
|
||||
inspectionId: 'inspection-secret-transition-1',
|
||||
},
|
||||
},
|
||||
];
|
||||
}
|
||||
|
||||
@@ -391,6 +432,42 @@ function secretBindingPlanSummary() {
|
||||
};
|
||||
}
|
||||
|
||||
function secretBindingTransitionPlanSummary() {
|
||||
const secretRef =
|
||||
'qlsecret:v1:eyJwcm9qZWN0SWQiOiJwcm9qZWN0LTEiLCJuYW1lIjoicnVudGltZS10b2tlbiIsInZlcnNpb24iOjJ9';
|
||||
return {
|
||||
actionRef: 'secret-transition:cluster-monitor:2',
|
||||
approvalPlanDigest: '1'.repeat(64),
|
||||
plannedAtMs: 1_000,
|
||||
expiresAtMs: 10_000,
|
||||
kind: 'rotate',
|
||||
transitionDigest: '2'.repeat(64),
|
||||
projectId: 'project-1',
|
||||
packageName: 'cluster-monitor',
|
||||
previousInstallationId: 'install-cluster-monitor-1',
|
||||
previousGeneration: 1,
|
||||
previousGenerationDigest: '3'.repeat(64),
|
||||
previousActiveLockDigest: '4'.repeat(64),
|
||||
previousAttemptGeneration: 1,
|
||||
nextInstallationId: 'install-cluster-monitor-2',
|
||||
nextGeneration: 2,
|
||||
nextGenerationDigest: '5'.repeat(64),
|
||||
nextLockDigest: '6'.repeat(64),
|
||||
nextManifestDigest: '7'.repeat(64),
|
||||
changes: [{
|
||||
name: 'TOKEN',
|
||||
requirement: 'unchanged',
|
||||
reference: 'rotated',
|
||||
previous: {
|
||||
required: true,
|
||||
secretRef:
|
||||
'qlsecret:v1:eyJwcm9qZWN0SWQiOiJwcm9qZWN0LTEiLCJuYW1lIjoicnVudGltZS10b2tlbiIsInZlcnNpb24iOjF9',
|
||||
},
|
||||
next: { required: true, secretRef },
|
||||
}],
|
||||
};
|
||||
}
|
||||
|
||||
function successfulResult(operation) {
|
||||
const secretApproval = {
|
||||
...approvalSummary(),
|
||||
@@ -398,6 +475,47 @@ function successfulResult(operation) {
|
||||
actionDigest: 'd'.repeat(64),
|
||||
previewDigest: 'c'.repeat(64),
|
||||
};
|
||||
const transitionApproval = {
|
||||
...approvalSummary(),
|
||||
id: 'approval-secret-transition-1',
|
||||
projectId: 'project-1',
|
||||
actionDigest: '1'.repeat(64),
|
||||
previewDigest: '2'.repeat(64),
|
||||
};
|
||||
if (operation === 'plugin-package.secret-binding.transition.plan') {
|
||||
return {
|
||||
schemaVersion: 1,
|
||||
operation,
|
||||
status: 'created',
|
||||
plan: secretBindingTransitionPlanSummary(),
|
||||
};
|
||||
}
|
||||
if (operation === 'plugin-package.secret-binding.transition.propose') {
|
||||
return {
|
||||
schemaVersion: 1,
|
||||
operation,
|
||||
approvalStatus: 'created',
|
||||
plan: secretBindingTransitionPlanSummary(),
|
||||
approval: transitionApproval,
|
||||
};
|
||||
}
|
||||
if (operation === 'plugin-package.secret-binding.transition.inspect') {
|
||||
return {
|
||||
schemaVersion: 1,
|
||||
operation,
|
||||
plan: secretBindingTransitionPlanSummary(),
|
||||
approval: transitionApproval,
|
||||
stale: false,
|
||||
};
|
||||
}
|
||||
if (operation === 'plugin-package.secret-binding.transition.decide') {
|
||||
return {
|
||||
schemaVersion: 1,
|
||||
operation,
|
||||
status: 'decided',
|
||||
approval: transitionApproval,
|
||||
};
|
||||
}
|
||||
if (operation === 'plugin-package.secret-binding.plan') {
|
||||
return {
|
||||
schemaVersion: 1,
|
||||
@@ -743,7 +861,7 @@ test('readiness probe rejects unreviewed status and bounded response drift', asy
|
||||
}
|
||||
});
|
||||
|
||||
test('permits and validates exactly the eighteen public management operations', async () => {
|
||||
test('permits and validates exactly the twenty-two public management operations', async () => {
|
||||
const received = [];
|
||||
const fixture = await startServer((request, response) => {
|
||||
const chunks = [];
|
||||
@@ -788,7 +906,7 @@ test('permits and validates exactly the eighteen public management operations',
|
||||
return true;
|
||||
},
|
||||
);
|
||||
assert.equal(received.length, 18);
|
||||
assert.equal(received.length, 22);
|
||||
} finally {
|
||||
await fixture.close();
|
||||
rmSync(files.directory, { recursive: true, force: true });
|
||||
|
||||
@@ -410,6 +410,116 @@ function fakeSecretBinding() {
|
||||
};
|
||||
}
|
||||
|
||||
function secretBindingTransitionPlan() {
|
||||
const previousSecretRef =
|
||||
'qlsecret:v1:eyJwcm9qZWN0SWQiOiJkZWZhdWx0IiwibmFtZSI6InJ1bnRpbWUtdG9rZW4iLCJ2ZXJzaW9uIjoxfQ';
|
||||
const nextSecretRef =
|
||||
'qlsecret:v1:eyJwcm9qZWN0SWQiOiJkZWZhdWx0IiwibmFtZSI6InJ1bnRpbWUtdG9rZW4iLCJ2ZXJzaW9uIjoyfQ';
|
||||
return {
|
||||
schema:
|
||||
'qinglong/plugin-package-secret-binding-transition-approval-plan@v1',
|
||||
actionRef: 'secret-transition:cluster-monitor:2',
|
||||
approvalPlanDigest: 'a'.repeat(64),
|
||||
requestedBy: { type: 'user', id: 'cluster-reviewer' },
|
||||
plannedAtMs: NOW - 10,
|
||||
expiresAtMs: NOW + 10_000,
|
||||
transitionPlan: {
|
||||
schema: 'qinglong/plugin-package-secret-binding-transition-plan@v1',
|
||||
kind: 'rotate',
|
||||
previousTarget: {
|
||||
installationId: 'cluster-monitor-installation-v1',
|
||||
projectId: 'default',
|
||||
packageName: 'cluster-monitor',
|
||||
lockDigest: '1'.repeat(64),
|
||||
generation: 1,
|
||||
generationDigest: '2'.repeat(64),
|
||||
manifestDigest: '3'.repeat(64),
|
||||
},
|
||||
previousBinding: null,
|
||||
previousActiveLockDigest: '1'.repeat(64),
|
||||
previousAttemptGeneration: 1,
|
||||
nextTarget: {
|
||||
installationId: 'cluster-monitor-installation-v2',
|
||||
projectId: 'default',
|
||||
packageName: 'cluster-monitor',
|
||||
lockDigest: '4'.repeat(64),
|
||||
generation: 2,
|
||||
generationDigest: '5'.repeat(64),
|
||||
manifestDigest: '6'.repeat(64),
|
||||
},
|
||||
nextBindingPlan: null,
|
||||
changes: [{
|
||||
name: 'TOKEN',
|
||||
requirement: 'unchanged',
|
||||
reference: 'rotated',
|
||||
previous: { required: true, secretRef: previousSecretRef },
|
||||
next: { required: true, secretRef: nextSecretRef },
|
||||
}],
|
||||
transitionDigest: 'b'.repeat(64),
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
function fakeSecretBindingTransition() {
|
||||
const calls = { plan: [], propose: [], decide: [], inspectAuthorized: [] };
|
||||
return {
|
||||
calls,
|
||||
service: {
|
||||
async plan(request) {
|
||||
calls.plan.push(request);
|
||||
return { status: 'created', plan: secretBindingTransitionPlan() };
|
||||
},
|
||||
async propose(request) {
|
||||
calls.propose.push(request);
|
||||
return {
|
||||
plan: secretBindingTransitionPlan(),
|
||||
approvalStatus: 'created',
|
||||
approvalRequest: approval({
|
||||
id: request.approvalRequestId,
|
||||
projectId: 'default',
|
||||
action: {
|
||||
permission: 'secret.manage',
|
||||
actionType: 'plugin_package.secret_binding.transition',
|
||||
actionRef: request.actionRef,
|
||||
actionDigest: 'a'.repeat(64),
|
||||
previewDigest: 'b'.repeat(64),
|
||||
},
|
||||
requestedBy: request.principal.subject,
|
||||
}),
|
||||
};
|
||||
},
|
||||
async decide(request) {
|
||||
calls.decide.push(request);
|
||||
return {
|
||||
status: 'decided',
|
||||
request: approval({
|
||||
id: request.approvalRequestId,
|
||||
projectId: 'default',
|
||||
version: 2,
|
||||
state: request.decision,
|
||||
decisionId: request.decisionId,
|
||||
decision: request.decision,
|
||||
decisionReasonCode: request.reasonCode,
|
||||
decidedBy: request.principal.subject,
|
||||
decisionAuthenticationId: request.principal.authenticationId,
|
||||
decisionAssurance: request.principal.assurance,
|
||||
decidedAtMs: NOW,
|
||||
decisionFence: { projectVersion: 1, bindingVersion: 1 },
|
||||
}),
|
||||
};
|
||||
},
|
||||
async inspectAuthorized(request) {
|
||||
calls.inspectAuthorized.push(request);
|
||||
return {
|
||||
plan: secretBindingTransitionPlan(),
|
||||
approvalRequest: null,
|
||||
stale: false,
|
||||
};
|
||||
},
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
function lifecyclePlan() {
|
||||
return {
|
||||
schema: 'qinglong/plugin-package-lifecycle-plan@v1',
|
||||
@@ -982,6 +1092,78 @@ test('routes content-free Secret binding review without executor authority', asy
|
||||
assert.deepEqual(management.calls.dispatch, []);
|
||||
});
|
||||
|
||||
test('routes content-free Secret transition review without executor authority', async () => {
|
||||
const management = fakeService();
|
||||
const transition = fakeSecretBindingTransition();
|
||||
const transport = createClusterPluginPackageManagementTransport({
|
||||
service: management.service,
|
||||
secretBindingTransition: transition.service,
|
||||
now: () => NOW,
|
||||
});
|
||||
const plan = secretBindingTransitionPlan();
|
||||
const assignments = plan.transitionPlan.changes
|
||||
.filter(({ next }) => next !== null)
|
||||
.map(({ name, next }) => ({ name, secretRef: next.secretRef }));
|
||||
const planned = await transport.execute({
|
||||
schemaVersion: 1,
|
||||
operation: 'plugin-package.secret-binding.transition.plan',
|
||||
request: {
|
||||
actionRef: plan.actionRef,
|
||||
projectId: 'default',
|
||||
packageName: 'cluster-monitor',
|
||||
assignments,
|
||||
},
|
||||
}, authentication().authority);
|
||||
assert.equal(planned.status, 'created');
|
||||
assert.equal(planned.plan.kind, 'rotate');
|
||||
assert.equal(planned.plan.previousGeneration, 1);
|
||||
assert.equal(planned.plan.nextGeneration, 2);
|
||||
assert.equal(Object.hasOwn(planned.plan, 'previousBinding'), false);
|
||||
|
||||
const proposed = await transport.execute({
|
||||
schemaVersion: 1,
|
||||
operation: 'plugin-package.secret-binding.transition.propose',
|
||||
request: {
|
||||
actionRef: plan.actionRef,
|
||||
approvalRequestId: 'approval-secret-transition-1',
|
||||
approvalAuditEventId: 'audit-secret-transition-approval-1',
|
||||
},
|
||||
}, authentication().authority);
|
||||
assert.equal(proposed.approvalStatus, 'created');
|
||||
|
||||
const decided = await transport.execute({
|
||||
schemaVersion: 1,
|
||||
operation: 'plugin-package.secret-binding.transition.decide',
|
||||
request: {
|
||||
actionRef: plan.actionRef,
|
||||
approvalRequestId: 'approval-secret-transition-1',
|
||||
expectedVersion: 1,
|
||||
decisionId: 'decision-secret-transition-1',
|
||||
auditEventId: 'audit-secret-transition-decision-1',
|
||||
decision: 'approved',
|
||||
reasonCode: 'reviewed',
|
||||
},
|
||||
}, authentication().authority);
|
||||
assert.equal(decided.status, 'decided');
|
||||
|
||||
const inspected = await transport.execute({
|
||||
schemaVersion: 1,
|
||||
operation: 'plugin-package.secret-binding.transition.inspect',
|
||||
request: {
|
||||
actionRef: plan.actionRef,
|
||||
approvalRequestId: 'approval-secret-transition-1',
|
||||
inspectionId: 'inspection-secret-transition-1',
|
||||
},
|
||||
}, authentication().authority);
|
||||
assert.equal(inspected.stale, false);
|
||||
assert.equal(transition.calls.plan.length, 1);
|
||||
assert.equal(transition.calls.propose.length, 1);
|
||||
assert.equal(transition.calls.decide.length, 1);
|
||||
assert.equal(transition.calls.inspectAuthorized.length, 1);
|
||||
assert.deepEqual(management.calls.consume, []);
|
||||
assert.deepEqual(management.calls.dispatch, []);
|
||||
});
|
||||
|
||||
test('routes publisher revocation proposal with derived-only low-sensitive output', async () => {
|
||||
const management = fakeService();
|
||||
const publisherTrust = fakePublisherTrust();
|
||||
|
||||
@@ -54,6 +54,7 @@ function executorPrivileges() {
|
||||
'approval_requests',
|
||||
'plugin_package_install_proposals',
|
||||
'plugin_package_secret_binding_approval_plans',
|
||||
'plugin_package_secret_binding_transition_approval_plans',
|
||||
'plugin_package_task_ownerships',
|
||||
'plugin_package_task_reconciliations',
|
||||
'plugin_package_task_reconciliation_items',
|
||||
@@ -217,6 +218,8 @@ function database(serverVersionNum = '160014') {
|
||||
'register_plugin_package_automation_disposition_event',
|
||||
'create_plugin_package_secret_binding_approval_plan',
|
||||
'plugin_package_secret_binding_planning_snapshot',
|
||||
'create_plugin_package_secret_transition_plan',
|
||||
'plugin_package_secret_binding_transition_snapshot',
|
||||
].includes(functionName),
|
||||
isOwner: false,
|
||||
})),
|
||||
|
||||
+285
@@ -11,6 +11,7 @@ const {
|
||||
createPostgresDatabaseOpener,
|
||||
PostgresPluginPackageSecretBindingApprovalPlanReader,
|
||||
PostgresPluginPackageSecretBindingRepository,
|
||||
PostgresPluginPackageSecretBindingTransitionApprovalPlanReader,
|
||||
} = require('@qinglong/cluster-postgres/package-executor');
|
||||
const {
|
||||
PostgresApprovedActionExecutionRepository,
|
||||
@@ -62,6 +63,12 @@ const {
|
||||
const {
|
||||
ClusterPluginPackageSecretBindingApprovedActionHandler,
|
||||
} = require('@qinglong/cluster-admin/plugin-package-secret-binding-approved-action');
|
||||
const {
|
||||
createClusterPluginPackageSecretBindingTransitionManagementService,
|
||||
} = require('@qinglong/cluster-admin/plugin-package-secret-binding-transition-management');
|
||||
const {
|
||||
consumeClusterPluginPackageSecretBindingTransitionApprovals,
|
||||
} = require('@qinglong/cluster-admin/plugin-package-secret-binding-transition-approval-consumer');
|
||||
|
||||
const MIGRATION_URL =
|
||||
process.env.QL3_TEST_POSTGRES_MIGRATION_URL ??
|
||||
@@ -525,6 +532,284 @@ if (!MIGRATION_URL || !MANAGER_URL || !EXECUTOR_URL) {
|
||||
assert.deepEqual(binding.entries, plannedPublic.plan.entries);
|
||||
assert.doesNotMatch(JSON.stringify(binding), /secret-value/);
|
||||
assert.equal((await secretDispatcher.dispatchBatch({ limit: 4 })).scanned, 0);
|
||||
|
||||
const manifestV2 = Object.freeze({
|
||||
...manifest,
|
||||
metadata: Object.freeze({ ...manifest.metadata, version: '2.0.0' }),
|
||||
});
|
||||
const actionInputV2 = Object.freeze({
|
||||
lockId: `lock-v2-${suffix}`,
|
||||
projectId,
|
||||
manifest: manifestV2,
|
||||
previousManifest: manifest,
|
||||
plan: planPluginPackageInstall(manifestV2, environment, manifest),
|
||||
environment,
|
||||
source: {
|
||||
kind: 'offline',
|
||||
locator: `offline:sha256:${'e'.repeat(64)}`,
|
||||
artifactDigest: 'e'.repeat(64),
|
||||
artifactBytes: 2048,
|
||||
contentDigest: 'f'.repeat(64),
|
||||
},
|
||||
architecture: 'arm64',
|
||||
deploymentProfile: 'cluster-control',
|
||||
targetGeneration: 2,
|
||||
previousLockDigest: lock.lockDigest,
|
||||
});
|
||||
const upgradeApprovalId = `upgrade-approval-${suffix}`;
|
||||
now += 10;
|
||||
const upgradeProposed = await installManagement.propose({
|
||||
actionRef: `install:${packageName}:v2`,
|
||||
approvalRequestId: upgradeApprovalId,
|
||||
proposalAuditEventId: randomUUID(),
|
||||
approvalAuditEventId: randomUUID(),
|
||||
requestedAtMs: now,
|
||||
actionInput: actionInputV2,
|
||||
principal: principal(requesterSubject, `upgrade-owner-${suffix}`, now),
|
||||
});
|
||||
now += 10;
|
||||
const upgradeDecision = await installManagement.decide({
|
||||
approvalRequestId: upgradeApprovalId,
|
||||
expectedVersion: upgradeProposed.approvalRequest.version,
|
||||
decisionId: `upgrade-decision-${suffix}`,
|
||||
auditEventId: randomUUID(),
|
||||
decision: 'approved',
|
||||
reasonCode: 'reviewed',
|
||||
decidedAtMs: now,
|
||||
principal: principal(reviewerSubject, `upgrade-reviewer-${suffix}`, now),
|
||||
});
|
||||
now += 10;
|
||||
const upgradeConsumed = await new PostgresApprovalRequestRepository(
|
||||
executor.pool,
|
||||
).consume({
|
||||
requestId: upgradeApprovalId,
|
||||
expectedVersion: upgradeDecision.request.version,
|
||||
consumptionId: `upgrade-consume-${suffix}`,
|
||||
dispatchId: `upgrade-dispatch-${suffix}`,
|
||||
action: upgradeDecision.request.action,
|
||||
requestedBy: requesterSubject,
|
||||
consumedBy: { type: 'system', id: 'cluster_package_executor' },
|
||||
consumedAtMs: now,
|
||||
authorizationFence: fence,
|
||||
audit: audit(
|
||||
randomUUID(),
|
||||
upgradeApprovalId,
|
||||
'approval.consume',
|
||||
projectId,
|
||||
{ type: 'system', id: 'cluster_package_executor' },
|
||||
now,
|
||||
fence,
|
||||
),
|
||||
});
|
||||
assert.equal(upgradeConsumed.status, 'consumed');
|
||||
id = 0;
|
||||
now += 10;
|
||||
const upgradeDispatch =
|
||||
await createClusterPluginPackageApprovedActionDispatcher({
|
||||
pool: executor.pool,
|
||||
owner: `upgrade-executor-${suffix}`,
|
||||
clock: () => now,
|
||||
createId: () => `upgrade-executor-id-${suffix}-${++id}`,
|
||||
secretExistenceInspector: inspector,
|
||||
}).dispatchBatch({ limit: 4 });
|
||||
assert.equal(upgradeDispatch.succeeded, 1);
|
||||
const queuedV2 = await installs.find(projectId, packageName);
|
||||
assert.ok(queuedV2);
|
||||
assert.equal(queuedV2.targetGeneration, 2);
|
||||
const lockV2 = await installs.findLock(queuedV2.lockDigest);
|
||||
assert.ok(lockV2);
|
||||
now += 10;
|
||||
const stagedV2 = transitionPluginPackageInstall(lockV2, queuedV2, {
|
||||
type: 'stage_completed',
|
||||
mutationId: `stage-v2-${suffix}`,
|
||||
occurredAtMs: now,
|
||||
stageRef: `stage:${lockV2.lockDigest}`,
|
||||
artifactDigest: lockV2.source.artifactDigest,
|
||||
manifestDigest: lockV2.manifestDigest,
|
||||
contentDigest: lockV2.source.contentDigest,
|
||||
evidenceDigest: '8'.repeat(64),
|
||||
});
|
||||
const provenanceV2 = createPluginPackagePublisherProvenance({
|
||||
projectId,
|
||||
packageName,
|
||||
installationId: queuedV2.installationId,
|
||||
lockDigest: lockV2.lockDigest,
|
||||
artifactDigest: stagedV2.stageReceipt.artifactDigest,
|
||||
manifestDigest: stagedV2.stageReceipt.manifestDigest,
|
||||
contentDigest: stagedV2.stageReceipt.contentDigest,
|
||||
stageEvidenceDigest: stagedV2.stageReceipt.evidenceDigest,
|
||||
signature: {
|
||||
publisher: 'integration.qinglong.dev',
|
||||
keyId: 'integration-key-1',
|
||||
signatureDigest: '9'.repeat(64),
|
||||
keyNotBeforeMs: now - 1,
|
||||
keyNotAfterMs: now + 60_000,
|
||||
verifiedAtMs: now,
|
||||
},
|
||||
});
|
||||
await executor.pool.query(
|
||||
`INSERT INTO "ql3"."plugin_package_publisher_provenance" (
|
||||
installation_id, project_id, package_name, lock_digest,
|
||||
artifact_digest, manifest_digest, content_digest,
|
||||
stage_evidence_digest, publisher, key_id, signature_digest,
|
||||
key_not_before_ms, key_not_after_ms, verified_at_ms,
|
||||
provenance_digest, provenance_json
|
||||
) VALUES (
|
||||
$1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11,
|
||||
$12, $13, $14, $15, $16::jsonb
|
||||
)`,
|
||||
[
|
||||
provenanceV2.installationId,
|
||||
provenanceV2.projectId,
|
||||
provenanceV2.packageName,
|
||||
provenanceV2.lockDigest,
|
||||
provenanceV2.artifactDigest,
|
||||
provenanceV2.manifestDigest,
|
||||
provenanceV2.contentDigest,
|
||||
provenanceV2.stageEvidenceDigest,
|
||||
provenanceV2.publisher,
|
||||
provenanceV2.keyId,
|
||||
provenanceV2.signatureDigest,
|
||||
provenanceV2.keyNotBeforeMs,
|
||||
provenanceV2.keyNotAfterMs,
|
||||
provenanceV2.verifiedAtMs,
|
||||
provenanceV2.provenanceDigest,
|
||||
JSON.stringify(provenanceV2),
|
||||
],
|
||||
);
|
||||
await installs.commit(pluginPackageInstallCommit(queuedV2, stagedV2));
|
||||
|
||||
const secretRefV2 = createSecretRef({
|
||||
projectId,
|
||||
name: 'runtime-token',
|
||||
version: 2,
|
||||
});
|
||||
writeFileSync(
|
||||
join(projectionRoot, secretProjectionFileName(secretRefV2)),
|
||||
'',
|
||||
{ mode: 0o440 },
|
||||
);
|
||||
const transitionActionRef = `secret-transition:${packageName}:v2`;
|
||||
const transitionApprovalId = `secret-transition-approval-${suffix}`;
|
||||
const transitionManagement =
|
||||
createClusterPluginPackageSecretBindingTransitionManagementService({
|
||||
pool: manager.pool,
|
||||
now: () => now,
|
||||
planLifetimeMs: 60_000,
|
||||
approvalLifetimeMs: 60_000,
|
||||
});
|
||||
const transitionTransport = createClusterPluginPackageManagementTransport({
|
||||
service: installManagement,
|
||||
secretBindingTransition: transitionManagement,
|
||||
now: () => now,
|
||||
});
|
||||
const transitionPlan = await transitionTransport.execute({
|
||||
schemaVersion: 1,
|
||||
operation: 'plugin-package.secret-binding.transition.plan',
|
||||
request: {
|
||||
actionRef: transitionActionRef,
|
||||
projectId,
|
||||
packageName,
|
||||
assignments: [{ name: 'TOKEN', secretRef: secretRefV2 }],
|
||||
},
|
||||
}, requesterAuthentication);
|
||||
assert.equal(transitionPlan.status, 'created');
|
||||
assert.equal(transitionPlan.plan.kind, 'rotate');
|
||||
assert.equal(transitionPlan.plan.previousGeneration, 1);
|
||||
assert.equal(transitionPlan.plan.nextGeneration, 2);
|
||||
assert.equal(
|
||||
transitionPlan.plan.previousActiveLockDigest,
|
||||
lock.lockDigest,
|
||||
);
|
||||
now = Math.max(now, transitionPlan.plan.plannedAtMs) + 10;
|
||||
const transitionProposed = await transitionTransport.execute({
|
||||
schemaVersion: 1,
|
||||
operation: 'plugin-package.secret-binding.transition.propose',
|
||||
request: {
|
||||
actionRef: transitionActionRef,
|
||||
approvalRequestId: transitionApprovalId,
|
||||
approvalAuditEventId: randomUUID(),
|
||||
},
|
||||
}, requesterAuthentication);
|
||||
now += 10;
|
||||
const transitionDecision = await transitionTransport.execute({
|
||||
schemaVersion: 1,
|
||||
operation: 'plugin-package.secret-binding.transition.decide',
|
||||
request: {
|
||||
actionRef: transitionActionRef,
|
||||
approvalRequestId: transitionApprovalId,
|
||||
expectedVersion: transitionProposed.approval.version,
|
||||
decisionId: `secret-transition-decision-${suffix}`,
|
||||
auditEventId: randomUUID(),
|
||||
decision: 'approved',
|
||||
reasonCode: 'reviewed',
|
||||
},
|
||||
}, {
|
||||
async authenticate() {
|
||||
return principal(
|
||||
reviewerSubject,
|
||||
`secret-transition-reviewer-${suffix}`,
|
||||
now,
|
||||
);
|
||||
},
|
||||
});
|
||||
assert.equal(transitionDecision.status, 'decided');
|
||||
now += 10;
|
||||
assert.deepEqual(
|
||||
await consumeClusterPluginPackageSecretBindingTransitionApprovals({
|
||||
pool: executor.pool,
|
||||
now: () => now,
|
||||
limit: 4,
|
||||
}),
|
||||
{ scanned: 1, consumed: 1, existing: 0, expired: 0, blocked: 0 },
|
||||
);
|
||||
const transitionApproval =
|
||||
await new PostgresApprovalRequestRepository(executor.pool).findById(
|
||||
transitionApprovalId,
|
||||
);
|
||||
assert.ok(transitionApproval?.dispatchId);
|
||||
const transitionExecution =
|
||||
await new PostgresApprovedActionExecutionRepository(
|
||||
executor.pool,
|
||||
).findExecutionByDispatchId(transitionApproval.dispatchId);
|
||||
assert.ok(transitionExecution);
|
||||
const storedTransitionPlan =
|
||||
await new PostgresPluginPackageSecretBindingTransitionApprovalPlanReader(
|
||||
executor.pool,
|
||||
).findByActionRef(transitionActionRef);
|
||||
assert.equal(
|
||||
storedTransitionPlan?.approvalPlanDigest,
|
||||
transitionPlan.plan.approvalPlanDigest,
|
||||
);
|
||||
id = 0;
|
||||
now += 10;
|
||||
const transitionDispatch =
|
||||
await createClusterPluginPackageApprovedActionDispatcher({
|
||||
pool: executor.pool,
|
||||
owner: `transition-executor-${suffix}`,
|
||||
clock: () => now,
|
||||
createId: () => `transition-executor-id-${suffix}-${++id}`,
|
||||
secretExistenceInspector: inspector,
|
||||
}).dispatchBatch({ limit: 4 });
|
||||
assert.equal(transitionDispatch.succeeded, 1);
|
||||
const transitionReceipt = await executor.pool.query(
|
||||
`SELECT receipt_json AS "receiptJson"
|
||||
FROM "ql3"."plugin_package_secret_binding_transition_receipts"
|
||||
WHERE generation_digest = $1`,
|
||||
[transitionPlan.plan.nextGenerationDigest],
|
||||
);
|
||||
assert.equal(transitionReceipt.rows.length, 1);
|
||||
assert.equal(
|
||||
transitionReceipt.rows[0].receiptJson.authority.evidenceDigest,
|
||||
transitionPlan.plan.approvalPlanDigest,
|
||||
);
|
||||
const bindingV2 = await bindings.find(
|
||||
transitionPlan.plan.nextGenerationDigest,
|
||||
);
|
||||
assert.ok(bindingV2);
|
||||
assert.deepEqual(bindingV2.entries, [
|
||||
{ name: 'TOKEN', required: false, secretRef: secretRefV2 },
|
||||
]);
|
||||
await assert.rejects(
|
||||
manager.pool.query(
|
||||
`SELECT * FROM "ql3"."plugin_package_secret_bindings" WHERE generation_digest = $1`,
|
||||
|
||||
+273
@@ -0,0 +1,273 @@
|
||||
'use strict';
|
||||
|
||||
const assert = require('node:assert/strict');
|
||||
const { test } = require('node:test');
|
||||
|
||||
const {
|
||||
approvalRequestDigest,
|
||||
createApprovalRequest,
|
||||
decideApprovalRequest,
|
||||
} = require('@qinglong/runtime-core/approved-action');
|
||||
const {
|
||||
createPluginPackageResourceGeneration,
|
||||
} = require('@qinglong/runtime-core/plugin-package-resource-generation');
|
||||
const {
|
||||
createPluginPackageSecretBinding,
|
||||
} = require('@qinglong/runtime-core/plugin-package-secret-binding');
|
||||
const {
|
||||
createPluginPackageSecretBindingTransitionApprovalPlan,
|
||||
pluginPackageSecretBindingTransitionApprovedAction,
|
||||
} = require('@qinglong/runtime-core/plugin-package-secret-binding-transition-approval-plan');
|
||||
const {
|
||||
createPluginPackageSecretBindingTransitionPlan,
|
||||
} = require('@qinglong/runtime-core/plugin-package-secret-binding-transition-plan');
|
||||
const { createSecretRef } = require('@qinglong/runtime-core/secret-reference');
|
||||
const {
|
||||
consumeClusterPluginPackageSecretBindingTransitionApprovals,
|
||||
} = require('@qinglong/cluster-admin/plugin-package-secret-binding-transition-approval-consumer');
|
||||
|
||||
const REQUESTER = Object.freeze({ type: 'user', id: 'cluster-owner' });
|
||||
const REVIEWER = Object.freeze({ type: 'user', id: 'security-reviewer' });
|
||||
const FENCE = Object.freeze({ projectVersion: 3, bindingVersion: 4 });
|
||||
|
||||
function manifest(version) {
|
||||
return {
|
||||
apiVersion: 'qinglong.io/v1alpha1',
|
||||
kind: 'Package',
|
||||
metadata: {
|
||||
name: 'example-monitor',
|
||||
displayName: 'Example Monitor',
|
||||
version,
|
||||
description: 'Secret transition consumer fixture',
|
||||
license: 'Apache-2.0',
|
||||
},
|
||||
spec: {
|
||||
compatibility: {
|
||||
qinglong: '>=3.0.0-0 <4.0.0',
|
||||
architectures: ['arm64'],
|
||||
deploymentProfiles: ['cluster-control'],
|
||||
},
|
||||
runtimes: [],
|
||||
resources: {
|
||||
memory: { recommended: '32Mi' },
|
||||
disk: { install: '4Mi', working: '8Mi' },
|
||||
},
|
||||
permissions: {
|
||||
network: { allowedHosts: [] },
|
||||
secrets: [{ name: 'TOKEN', required: true }],
|
||||
tools: ['secret.use'],
|
||||
},
|
||||
contents: { tasks: [], workflows: [], prompts: [], tools: [] },
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
function plan() {
|
||||
const previousManifest = manifest('1.0.0');
|
||||
const previousGeneration = createPluginPackageResourceGeneration({
|
||||
installationId: 'install-secret-transition-v1',
|
||||
projectId: 'project-1',
|
||||
packageName: 'example-monitor',
|
||||
lockDigest: 'a'.repeat(64),
|
||||
generation: 1,
|
||||
previousActiveLockDigest: null,
|
||||
contentDigest: 'b'.repeat(64),
|
||||
contents: previousManifest.spec.contents,
|
||||
});
|
||||
const previousBinding = createPluginPackageSecretBinding({
|
||||
generation: previousGeneration,
|
||||
manifest: previousManifest,
|
||||
assignments: [{
|
||||
name: 'TOKEN',
|
||||
secretRef: createSecretRef({
|
||||
projectId: 'project-1',
|
||||
name: 'runtime-token',
|
||||
version: 1,
|
||||
}),
|
||||
}],
|
||||
authority: {
|
||||
kind: 'approved-action-execution',
|
||||
evidenceDigest: 'c'.repeat(64),
|
||||
},
|
||||
boundAtMs: 80,
|
||||
});
|
||||
const nextManifest = manifest('2.0.0');
|
||||
const transitionPlan = createPluginPackageSecretBindingTransitionPlan({
|
||||
previousTarget: previousBinding.target,
|
||||
previousBinding,
|
||||
previousAttemptGeneration: 1,
|
||||
nextGeneration: createPluginPackageResourceGeneration({
|
||||
installationId: 'install-secret-transition-v2',
|
||||
projectId: 'project-1',
|
||||
packageName: 'example-monitor',
|
||||
lockDigest: 'd'.repeat(64),
|
||||
generation: 2,
|
||||
previousActiveLockDigest: 'a'.repeat(64),
|
||||
contentDigest: 'e'.repeat(64),
|
||||
contents: nextManifest.spec.contents,
|
||||
}),
|
||||
nextManifest,
|
||||
assignments: [{
|
||||
name: 'TOKEN',
|
||||
secretRef: createSecretRef({
|
||||
projectId: 'project-1',
|
||||
name: 'runtime-token',
|
||||
version: 2,
|
||||
}),
|
||||
}],
|
||||
plannedAtMs: 100,
|
||||
});
|
||||
return createPluginPackageSecretBindingTransitionApprovalPlan({
|
||||
actionRef: 'secret-transition:example-monitor-v2',
|
||||
transitionPlan,
|
||||
requestedBy: REQUESTER,
|
||||
plannedAtMs: 100,
|
||||
expiresAtMs: 1_000,
|
||||
});
|
||||
}
|
||||
|
||||
function approvedRequest(candidate) {
|
||||
return decideApprovalRequest(
|
||||
createApprovalRequest({
|
||||
id: 'approval-secret-transition-1',
|
||||
projectId: 'project-1',
|
||||
action: pluginPackageSecretBindingTransitionApprovedAction(candidate),
|
||||
risk: 'high',
|
||||
decisionMode: 'separation_of_duty',
|
||||
requestedBy: REQUESTER,
|
||||
requestedAtMs: 110,
|
||||
expiresAtMs: 900,
|
||||
requestFence: FENCE,
|
||||
}),
|
||||
{
|
||||
expectedVersion: 1,
|
||||
decisionId: 'decision-secret-transition-1',
|
||||
decision: 'approved',
|
||||
reasonCode: 'reviewed',
|
||||
principal: {
|
||||
subject: REVIEWER,
|
||||
authenticationId: 'auth-reviewer',
|
||||
authenticatedAtMs: 100,
|
||||
expiresAtMs: 800,
|
||||
assurance: 'multi_factor',
|
||||
},
|
||||
decidedAtMs: 120,
|
||||
authorizationFence: FENCE,
|
||||
},
|
||||
);
|
||||
}
|
||||
|
||||
function pool(candidate, request, policyEffect = 'allow') {
|
||||
const dispatches = new Map();
|
||||
return {
|
||||
dispatches,
|
||||
async query(text, values) {
|
||||
if (text.includes('JOIN "ql3"."plugin_package_secret_binding_transition_approval_plans"')) {
|
||||
return {
|
||||
rows: [{
|
||||
requestJson: request,
|
||||
requestDigest: approvalRequestDigest(request),
|
||||
}],
|
||||
};
|
||||
}
|
||||
if (text.includes('FROM "ql3"."plugin_package_secret_binding_transition_approval_plans"')) {
|
||||
return { rows: [{ planJson: candidate }] };
|
||||
}
|
||||
if (text.includes('FROM "ql3"."projects" AS project')) {
|
||||
return policyEffect === 'deny'
|
||||
? { rows: [] }
|
||||
: {
|
||||
rows: [{
|
||||
projectId: 'project-1',
|
||||
projectName: 'Project 1',
|
||||
projectSlug: 'project-1',
|
||||
projectStatus: 'active',
|
||||
projectVersion: 3,
|
||||
projectCreatedAtMs: 1,
|
||||
projectUpdatedAtMs: 2,
|
||||
bindingProjectId: 'project-1',
|
||||
bindingSubjectType: 'user',
|
||||
bindingSubjectId: 'cluster-owner',
|
||||
bindingVersion: 4,
|
||||
bindingState: 'active',
|
||||
bindingRole: 'admin',
|
||||
bindingMutationId: 'binding-owner-v4',
|
||||
bindingChangedByType: 'user',
|
||||
bindingChangedById: 'root-owner',
|
||||
bindingCreatedAtMs: 2,
|
||||
}],
|
||||
};
|
||||
}
|
||||
if (
|
||||
text === 'BEGIN ISOLATION LEVEL SERIALIZABLE' ||
|
||||
text === 'COMMIT' ||
|
||||
text === 'ROLLBACK'
|
||||
) return { rows: [] };
|
||||
if (text.includes('SELECT set_config(')) return { rows: [{}] };
|
||||
if (text.includes('lock_approval_policy_fence')) {
|
||||
return { rows: [{ matches: true }] };
|
||||
}
|
||||
if (text.includes('FROM "ql3"."approval_requests"')) {
|
||||
return {
|
||||
rows: [{
|
||||
requestJson: request,
|
||||
requestDigest: approvalRequestDigest(request),
|
||||
}],
|
||||
};
|
||||
}
|
||||
if (text.includes('INSERT INTO "ql3"."approved_action_dispatches"')) {
|
||||
dispatches.set(values[0], values);
|
||||
return { rows: [], rowCount: 1 };
|
||||
}
|
||||
if (text.includes('INSERT INTO "ql3"."approved_action_executions"')) {
|
||||
return { rows: [], rowCount: 1 };
|
||||
}
|
||||
if (text.includes('UPDATE "ql3"."approval_requests"')) {
|
||||
return { rows: [], rowCount: 1 };
|
||||
}
|
||||
if (text.includes('INSERT INTO "ql3"."security_audit_events"')) {
|
||||
return { rows: [], rowCount: 1 };
|
||||
}
|
||||
throw new Error(`unexpected query: ${text}`);
|
||||
},
|
||||
async connect() {
|
||||
return { query: this.query.bind(this), release() {} };
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
test('consumes one exact approved Secret transition under a current requester fence', async () => {
|
||||
const candidate = plan();
|
||||
const request = approvedRequest(candidate);
|
||||
const database = pool(candidate, request);
|
||||
assert.deepEqual(
|
||||
await consumeClusterPluginPackageSecretBindingTransitionApprovals({
|
||||
pool: database,
|
||||
now: () => 130,
|
||||
limit: 4,
|
||||
}),
|
||||
{ scanned: 1, consumed: 1, existing: 0, expired: 0, blocked: 0 },
|
||||
);
|
||||
assert.equal(database.dispatches.size, 1);
|
||||
});
|
||||
|
||||
test('does not consume expired or no-longer-authorized Secret transitions', async () => {
|
||||
const candidate = plan();
|
||||
const request = approvedRequest(candidate);
|
||||
assert.deepEqual(
|
||||
await consumeClusterPluginPackageSecretBindingTransitionApprovals({
|
||||
pool: pool(candidate, request),
|
||||
now: () => 901,
|
||||
limit: 4,
|
||||
}),
|
||||
{ scanned: 1, consumed: 0, existing: 0, expired: 1, blocked: 0 },
|
||||
);
|
||||
assert.deepEqual(
|
||||
await consumeClusterPluginPackageSecretBindingTransitionApprovals({
|
||||
pool: pool(candidate, request, 'deny'),
|
||||
now: () => 130,
|
||||
limit: 4,
|
||||
}),
|
||||
{ scanned: 1, consumed: 0, existing: 0, expired: 0, blocked: 1 },
|
||||
);
|
||||
});
|
||||
+289
@@ -0,0 +1,289 @@
|
||||
'use strict';
|
||||
|
||||
const assert = require('node:assert/strict');
|
||||
const { test } = require('node:test');
|
||||
|
||||
const {
|
||||
consumeApprovalRequest,
|
||||
createApprovalRequest,
|
||||
decideApprovalRequest,
|
||||
} = require('@qinglong/runtime-core/approved-action');
|
||||
const {
|
||||
claimApprovedActionExecution,
|
||||
createApprovedActionExecution,
|
||||
startApprovedActionExecution,
|
||||
} = require('@qinglong/runtime-core/approved-action-execution');
|
||||
const {
|
||||
createPluginPackageResourceGeneration,
|
||||
} = require('@qinglong/runtime-core/plugin-package-resource-generation');
|
||||
const {
|
||||
createPluginPackageSecretBinding,
|
||||
} = require('@qinglong/runtime-core/plugin-package-secret-binding');
|
||||
const {
|
||||
createPluginPackageSecretBindingTransitionApprovalPlan,
|
||||
pluginPackageSecretBindingTransitionApprovedAction,
|
||||
} = require('@qinglong/runtime-core/plugin-package-secret-binding-transition-approval-plan');
|
||||
const {
|
||||
createPluginPackageSecretBindingTransitionPlan,
|
||||
} = require('@qinglong/runtime-core/plugin-package-secret-binding-transition-plan');
|
||||
const { createSecretRef } = require('@qinglong/runtime-core/secret-reference');
|
||||
const {
|
||||
ClusterPluginPackageSecretBindingTransitionApprovedActionHandler,
|
||||
} = require('@qinglong/cluster-admin/plugin-package-secret-binding-transition-approved-action');
|
||||
|
||||
const REQUESTER = Object.freeze({ type: 'user', id: 'cluster-owner' });
|
||||
const REVIEWER = Object.freeze({ type: 'user', id: 'security-reviewer' });
|
||||
const CONSUMER = Object.freeze({
|
||||
type: 'system',
|
||||
id: 'cluster_package_executor',
|
||||
});
|
||||
const FENCE = Object.freeze({ projectVersion: 3, bindingVersion: 4 });
|
||||
|
||||
function manifest(version) {
|
||||
return {
|
||||
apiVersion: 'qinglong.io/v1alpha1',
|
||||
kind: 'Package',
|
||||
metadata: {
|
||||
name: 'example-monitor',
|
||||
displayName: 'Example Monitor',
|
||||
version,
|
||||
description: 'Secret transition handler fixture',
|
||||
license: 'Apache-2.0',
|
||||
},
|
||||
spec: {
|
||||
compatibility: {
|
||||
qinglong: '>=3.0.0-0 <4.0.0',
|
||||
architectures: ['arm64'],
|
||||
deploymentProfiles: ['cluster-control'],
|
||||
},
|
||||
runtimes: [],
|
||||
resources: {
|
||||
memory: { recommended: '32Mi' },
|
||||
disk: { install: '4Mi', working: '8Mi' },
|
||||
},
|
||||
permissions: {
|
||||
network: { allowedHosts: [] },
|
||||
secrets: [{ name: 'TOKEN', required: true }],
|
||||
tools: ['secret.use'],
|
||||
},
|
||||
contents: { tasks: [], workflows: [], prompts: [], tools: [] },
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
function approvalPlan() {
|
||||
const previousManifest = manifest('1.0.0');
|
||||
const previousGeneration = createPluginPackageResourceGeneration({
|
||||
installationId: 'install-secret-transition-v1',
|
||||
projectId: 'project-1',
|
||||
packageName: 'example-monitor',
|
||||
lockDigest: 'a'.repeat(64),
|
||||
generation: 1,
|
||||
previousActiveLockDigest: null,
|
||||
contentDigest: 'b'.repeat(64),
|
||||
contents: previousManifest.spec.contents,
|
||||
});
|
||||
const previousBinding = createPluginPackageSecretBinding({
|
||||
generation: previousGeneration,
|
||||
manifest: previousManifest,
|
||||
assignments: [{
|
||||
name: 'TOKEN',
|
||||
secretRef: createSecretRef({
|
||||
projectId: 'project-1',
|
||||
name: 'runtime-token',
|
||||
version: 1,
|
||||
}),
|
||||
}],
|
||||
authority: {
|
||||
kind: 'approved-action-execution',
|
||||
evidenceDigest: 'c'.repeat(64),
|
||||
},
|
||||
boundAtMs: 80,
|
||||
});
|
||||
const nextManifest = manifest('2.0.0');
|
||||
const transitionPlan = createPluginPackageSecretBindingTransitionPlan({
|
||||
previousTarget: previousBinding.target,
|
||||
previousBinding,
|
||||
previousAttemptGeneration: 1,
|
||||
nextGeneration: createPluginPackageResourceGeneration({
|
||||
installationId: 'install-secret-transition-v2',
|
||||
projectId: 'project-1',
|
||||
packageName: 'example-monitor',
|
||||
lockDigest: 'd'.repeat(64),
|
||||
generation: 2,
|
||||
previousActiveLockDigest: 'a'.repeat(64),
|
||||
contentDigest: 'e'.repeat(64),
|
||||
contents: nextManifest.spec.contents,
|
||||
}),
|
||||
nextManifest,
|
||||
assignments: [{
|
||||
name: 'TOKEN',
|
||||
secretRef: createSecretRef({
|
||||
projectId: 'project-1',
|
||||
name: 'runtime-token',
|
||||
version: 2,
|
||||
}),
|
||||
}],
|
||||
plannedAtMs: 100,
|
||||
});
|
||||
return createPluginPackageSecretBindingTransitionApprovalPlan({
|
||||
actionRef: 'secret-transition:example-monitor-v2',
|
||||
transitionPlan,
|
||||
requestedBy: REQUESTER,
|
||||
plannedAtMs: 100,
|
||||
expiresAtMs: 1_000,
|
||||
});
|
||||
}
|
||||
|
||||
function dispatch(plan) {
|
||||
const action = pluginPackageSecretBindingTransitionApprovedAction(plan);
|
||||
const pending = createApprovalRequest({
|
||||
id: 'approval-secret-transition-1',
|
||||
projectId: 'project-1',
|
||||
action,
|
||||
risk: 'high',
|
||||
decisionMode: 'separation_of_duty',
|
||||
requestedBy: REQUESTER,
|
||||
requestedAtMs: 110,
|
||||
expiresAtMs: 900,
|
||||
requestFence: FENCE,
|
||||
});
|
||||
const approved = decideApprovalRequest(pending, {
|
||||
expectedVersion: 1,
|
||||
decisionId: 'decision-secret-transition-1',
|
||||
decision: 'approved',
|
||||
reasonCode: 'reviewed',
|
||||
principal: {
|
||||
subject: REVIEWER,
|
||||
authenticationId: 'auth-reviewer',
|
||||
authenticatedAtMs: 100,
|
||||
expiresAtMs: 800,
|
||||
assurance: 'multi_factor',
|
||||
},
|
||||
decidedAtMs: 120,
|
||||
authorizationFence: FENCE,
|
||||
});
|
||||
return consumeApprovalRequest(approved, {
|
||||
expectedVersion: 2,
|
||||
consumptionId: 'consume-secret-transition-1',
|
||||
dispatchId: 'dispatch-secret-transition-1',
|
||||
action,
|
||||
requestedBy: REQUESTER,
|
||||
consumedBy: CONSUMER,
|
||||
consumedAtMs: 130,
|
||||
authorizationFence: FENCE,
|
||||
}).dispatch;
|
||||
}
|
||||
|
||||
function execution(approvedDispatch, startedAtMs = 140) {
|
||||
const claimed = claimApprovedActionExecution(
|
||||
createApprovedActionExecution(approvedDispatch, 5),
|
||||
{
|
||||
owner: 'secret-transition-executor',
|
||||
leaseToken: 'lease-secret-transition-1',
|
||||
nowMs: 131,
|
||||
leaseDurationMs: 2_000,
|
||||
},
|
||||
);
|
||||
return startApprovedActionExecution(
|
||||
{ dispatch: approvedDispatch, execution: claimed },
|
||||
{
|
||||
dispatchId: approvedDispatch.id,
|
||||
approvalRequestId: approvedDispatch.approvalRequestId,
|
||||
actionDigest: approvedDispatch.action.actionDigest,
|
||||
owner: claimed.leaseOwner,
|
||||
leaseToken: claimed.leaseToken,
|
||||
expectedVersion: claimed.version,
|
||||
startedAtMs,
|
||||
},
|
||||
);
|
||||
}
|
||||
|
||||
test('commits exactly one approved transition and verifies projected references', async () => {
|
||||
const plan = approvalPlan();
|
||||
const approvedDispatch = dispatch(plan);
|
||||
const started = execution(approvedDispatch);
|
||||
const applied = [];
|
||||
const inspected = [];
|
||||
const subject = new ClusterPluginPackageSecretBindingTransitionApprovedActionHandler(
|
||||
{ async findByActionRef() { return plan; } },
|
||||
{
|
||||
async apply(input) {
|
||||
applied.push(input);
|
||||
return {
|
||||
status: 'created',
|
||||
receipt: { receiptDigest: 'f'.repeat(64) },
|
||||
};
|
||||
},
|
||||
},
|
||||
{ async assertExists(refs) { inspected.push(...refs); } },
|
||||
);
|
||||
assert.deepEqual(await subject.inspect(approvedDispatch), {
|
||||
status: 'ready',
|
||||
actionDigest: plan.approvalPlanDigest,
|
||||
});
|
||||
const result = await subject.execute({
|
||||
dispatch: approvedDispatch,
|
||||
execution: started,
|
||||
idempotencyKey: approvedDispatch.id,
|
||||
fence: {
|
||||
owner: started.leaseOwner,
|
||||
leaseToken: started.leaseToken,
|
||||
version: started.version,
|
||||
},
|
||||
});
|
||||
assert.deepEqual(result, {
|
||||
outcome: 'succeeded',
|
||||
resultCode: 'package_secret_transition_committed',
|
||||
resultDigest: 'f'.repeat(64),
|
||||
});
|
||||
assert.equal(applied.length, 1);
|
||||
assert.deepEqual(applied[0], {
|
||||
transitionPlan: plan.transitionPlan,
|
||||
evidenceDigest: plan.approvalPlanDigest,
|
||||
committedAtMs: 140,
|
||||
});
|
||||
assert.deepEqual(inspected, [
|
||||
plan.transitionPlan.nextBindingPlan.entries[0].secretRef,
|
||||
plan.transitionPlan.nextBindingPlan.entries[0].secretRef,
|
||||
]);
|
||||
});
|
||||
|
||||
test('blocks plan drift and execution that starts after plan expiry', async () => {
|
||||
const plan = approvalPlan();
|
||||
const approvedDispatch = dispatch(plan);
|
||||
const applied = [];
|
||||
const subject = new ClusterPluginPackageSecretBindingTransitionApprovedActionHandler(
|
||||
{ async findByActionRef() { return plan; } },
|
||||
{ async apply(input) { applied.push(input); throw new Error('must not apply'); } },
|
||||
{ async assertExists() {} },
|
||||
);
|
||||
const late = execution(approvedDispatch, 1_001);
|
||||
assert.deepEqual(
|
||||
await subject.execute({
|
||||
dispatch: approvedDispatch,
|
||||
execution: late,
|
||||
idempotencyKey: approvedDispatch.id,
|
||||
fence: {
|
||||
owner: late.leaseOwner,
|
||||
leaseToken: late.leaseToken,
|
||||
version: late.version,
|
||||
},
|
||||
}),
|
||||
{
|
||||
outcome: 'failed',
|
||||
resultCode: 'package_secret_transition_plan_rejected',
|
||||
},
|
||||
);
|
||||
assert.equal(applied.length, 0);
|
||||
const drifted = { ...plan, approvalPlanDigest: '9'.repeat(64) };
|
||||
const driftedSubject = new ClusterPluginPackageSecretBindingTransitionApprovedActionHandler(
|
||||
{ async findByActionRef() { return drifted; } },
|
||||
{ async apply() { throw new Error('must not apply'); } },
|
||||
{ async assertExists() {} },
|
||||
);
|
||||
assert.deepEqual(await driftedSubject.inspect(approvedDispatch), {
|
||||
status: 'blocked',
|
||||
resultCode: 'package_secret_transition_plan_rejected',
|
||||
});
|
||||
});
|
||||
Reference in New Issue
Block a user