open-source/qinglong
1
0
Fork 0
mirror of https://github.com/whyour/qinglong.git synced 2026-09-22 10:32:40 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(ql3): separate cluster secret transition authority

Browse Source
This commit is contained in:
whyour
2026-08-13 22:56:02 +08:00
parent 5f93e0b5d2
commit d41c821ce0
34 changed files with 4157 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/ql3-cluster-postgres/test/postgresqlMigrationDefinitions.test.cjs
+55
View File
@@ -114,6 +114,7 @@ test('defines the immutable PostgreSQL capability and Run core stream', async ()
'pg-0061-plugin-package-secret-binding-approval-plans',
'pg-0062-plugin-package-secret-binding-target-guard',
'pg-0063-plugin-package-secret-binding-transition-receipts',
'pg-0064-plugin-package-secret-binding-transition-approval-plans',
],
);
for (const migration of postgresqlMainMigrationStream.migrations) {
@@ -567,6 +568,11 @@ test('freezes every published PostgreSQL migration checksum', () => {
checksum:
'20c4d6e640b7fb05fc2f44dd9bec6d2d081697b83acf4e7dd5deb9a07afe54df',
},
{
id: 'pg-0064-plugin-package-secret-binding-transition-approval-plans',
checksum:
'1951b77a0265f8826169e4724424b2fbbd30061b27e27d3ba95de03430c1bac9',
},
];
assert.deepEqual(
postgresqlMainMigrationStream.migrations.map(({ id, checksum }) => ({
@@ -2172,3 +2178,52 @@ test('advances capability v62 with immutable Secret binding transition receipts'
/migration_id = 'pg-0062-plugin-package-secret-binding-target-guard'/,
);
});
test('advances capability v63 with manager-only immutable Secret transition plans', async () => {
const migration = migrationById(
'pg-0064-plugin-package-secret-binding-transition-approval-plans',
);
const statements = [];
await migration.up({
async query(statement) {
statements.push(statement);
return { rows: [] };
},
});
const sql = statements.join('\n');
assert.match(
sql,
/CREATE TABLE "ql3"\."plugin_package_secret_binding_transition_approval_plans"/,
);
assert.match(
sql,
/CREATE FUNCTION "ql3"\."plugin_package_secret_binding_transition_snapshot"\(/,
);
assert.match(
sql,
/CREATE FUNCTION "ql3"\."create_plugin_package_secret_transition_plan"\(/,
);
assert.match(sql, /SECURITY DEFINER/);
assert.match(sql, /previous\.state = 'active'/);
assert.match(sql, /install\.state = 'staged'/);
assert.match(sql, /previous_binding\.binding_json = p_plan_json/);
assert.match(
sql,
/GRANT SELECT ON "ql3"\."plugin_package_secret_binding_transition_approval_plans" TO ql3_package_manager, ql3_package_executor/,
);
assert.match(
sql,
/GRANT EXECUTE ON FUNCTION [^;]+ TO ql3_package_manager/,
);
assert.doesNotMatch(sql, /GRANT EXECUTE ON FUNCTION [^;]+ TO ql3_package_executor/);
assert.match(sql, /contract_version = 63/);
assert.match(
sql,
/"plugin_package_secret_binding_transition_approval_plan":1/,
);
assert.match(sql, /contract_version = 62/);
assert.match(
sql,
/migration_id = 'pg-0063-plugin-package-secret-binding-transition-receipts'/,
);
});
packages/ql3-cluster-postgres/test/postgresqlSchemaReadiness.test.cjs
+27 -11
View File
@@ -76,6 +76,12 @@ function validPrivileges() {
plugin_package_materialized_revisions: [false, false, false, false],
plugin_package_secret_bindings: [false, false, false, false],
plugin_package_secret_binding_approval_plans: [false, false, false, false],
plugin_package_secret_binding_transition_approval_plans: [
false,
false,
false,
false,
],
plugin_package_secret_binding_transition_receipts: [
false,
false,
@@ -202,6 +208,12 @@ function validAdminPrivileges() {
plugin_package_materialized_revisions: [false, false, false, false],
plugin_package_secret_bindings: [false, false, false, false],
plugin_package_secret_binding_approval_plans: [false, false, false, false],
plugin_package_secret_binding_transition_approval_plans: [
false,
false,
false,
false,
],
plugin_package_secret_binding_transition_receipts: [
false,
false,
@@ -302,6 +314,7 @@ function packagePrivileges(kind) {
'plugin_package_publisher_trust_transition_receipts',
'plugin_package_lifecycle_plans',
'plugin_package_secret_binding_approval_plans',
'plugin_package_secret_binding_transition_approval_plans',
'plugin_package_automation_publications',
'plugin_package_automation_publication_heads',
...(manager
@@ -686,9 +699,11 @@ function queryable(overrides = {}) {
executeAllowed:
overrides.functionMode === 'package-manager'
? [
'create_plugin_package_secret_transition_plan',
'create_plugin_package_secret_binding_approval_plan',
'lock_approval_policy_fence',
'plugin_package_secret_binding_planning_snapshot',
'plugin_package_secret_binding_transition_snapshot',
].includes(functionName)
: overrides.functionMode === 'manager'
? functionName === 'lock_approval_policy_fence'
@@ -790,7 +805,7 @@ test('accepts the exact PostgreSQL control schema and least-privilege runtime ro
serverMajor: 16,
currentUser: 'ql3_runtime',
contractName: 'control-core',
contractVersion: 62,
contractVersion: 63,
migrationIds: [
'pg-0001-schema-capability',
'pg-0002-run-core',
@@ -855,6 +870,7 @@ test('accepts the exact PostgreSQL control schema and least-privilege runtime ro
'pg-0061-plugin-package-secret-binding-approval-plans',
'pg-0062-plugin-package-secret-binding-target-guard',
'pg-0063-plugin-package-secret-binding-transition-receipts',
'pg-0064-plugin-package-secret-binding-transition-approval-plans',
],
});
});
@@ -885,10 +901,10 @@ test('accepts the exact schema and isolated least-privilege admin role', async (
}),
);
assert.equal(report.currentUser, 'ql3_admin');
assert.equal(report.contractVersion, 62);
assert.equal(report.contractVersion, 63);
assert.equal(
report.migrationIds.at(-1),
'pg-0063-plugin-package-secret-binding-transition-receipts',
'pg-0064-plugin-package-secret-binding-transition-approval-plans',
);
});
@@ -901,10 +917,10 @@ test('accepts the isolated least-privilege automation manager role', async () =>
}),
);
assert.equal(report.currentUser, 'ql3_automation_manager');
assert.equal(report.contractVersion, 62);
assert.equal(report.contractVersion, 63);
assert.equal(
report.migrationIds.at(-1),
'pg-0063-plugin-package-secret-binding-transition-receipts',
'pg-0064-plugin-package-secret-binding-transition-approval-plans',
);
const widened = automationManagerPrivileges();
@@ -933,10 +949,10 @@ test('accepts the isolated least-privilege human Approval manager role', async (
}),
);
assert.equal(report.currentUser, 'ql3_approval_manager');
assert.equal(report.contractVersion, 62);
assert.equal(report.contractVersion, 63);
assert.equal(
report.migrationIds.at(-1),
'pg-0063-plugin-package-secret-binding-transition-receipts',
'pg-0064-plugin-package-secret-binding-transition-approval-plans',
);
const widened = approvalManagerPrivileges();
@@ -967,10 +983,10 @@ test('accepts the isolated least-privilege Run manager role', async () => {
}),
);
assert.equal(report.currentUser, 'ql3_run_manager');
assert.equal(report.contractVersion, 62);
assert.equal(report.contractVersion, 63);
assert.equal(
report.migrationIds.at(-1),
'pg-0063-plugin-package-secret-binding-transition-receipts',
'pg-0064-plugin-package-secret-binding-transition-approval-plans',
);
const widened = runManagerPrivileges();
@@ -1102,10 +1118,10 @@ test('accepts the exact schema and isolated Worker ingress role', async () => {
}),
);
assert.equal(report.currentUser, 'ql3_worker_ingress');
assert.equal(report.contractVersion, 62);
assert.equal(report.contractVersion, 63);
assert.equal(
report.migrationIds.at(-1),
'pg-0063-plugin-package-secret-binding-transition-receipts',
'pg-0064-plugin-package-secret-binding-transition-approval-plans',
);
});