mirror of
https://github.com/whyour/qinglong.git
synced 2026-09-20 16:07:11 +08:00
feat(ql3): separate cluster secret transition authority
This commit is contained in:
whyour
@@ -95,6 +95,9 @@
|
||||
"plugin-package-secret-binding-transition-receipt": [
|
||||
"dist/plugin-package/secret-binding/transitionReceipt.d.ts"
|
||||
],
|
||||
"plugin-package-secret-binding-transition-approval-plan": [
|
||||
"dist/plugin-package/secret-binding/transitionApprovalPlan.d.ts"
|
||||
],
|
||||
"plugin-package-secret-binding-approval-plan": [
|
||||
"dist/plugin-package/secret-binding/approvalPlan.d.ts"
|
||||
],
|
||||
@@ -409,6 +412,11 @@
|
||||
"require": "./dist/plugin-package/secret-binding/transitionReceipt.js",
|
||||
"default": "./dist/plugin-package/secret-binding/transitionReceipt.js"
|
||||
},
|
||||
"./plugin-package-secret-binding-transition-approval-plan": {
|
||||
"types": "./dist/plugin-package/secret-binding/transitionApprovalPlan.d.ts",
|
||||
"require": "./dist/plugin-package/secret-binding/transitionApprovalPlan.js",
|
||||
"default": "./dist/plugin-package/secret-binding/transitionApprovalPlan.js"
|
||||
},
|
||||
"./plugin-package-secret-binding-approval-plan": {
|
||||
"types": "./dist/plugin-package/secret-binding/approvalPlan.d.ts",
|
||||
"require": "./dist/plugin-package/secret-binding/approvalPlan.js",
|
||||
|
||||
+316
@@ -0,0 +1,316 @@
|
||||
import { createHash } from 'node:crypto';
|
||||
|
||||
import type { ApprovedActionBinding } from '../../approved-action/approvedAction';
|
||||
import type { SecuritySubject } from '../../security/security';
|
||||
import {
|
||||
normalizePluginPackageSecretBindingTransitionPlan,
|
||||
type PluginPackageSecretBindingTransitionPlan,
|
||||
} from './transitionPlan';
|
||||
|
||||
export const PLUGIN_PACKAGE_SECRET_BINDING_TRANSITION_APPROVAL_PLAN_SCHEMA =
|
||||
'qinglong/plugin-package-secret-binding-transition-approval-plan@v1' as const;
|
||||
export const PLUGIN_PACKAGE_SECRET_BINDING_TRANSITION_ACTION_TYPE =
|
||||
'plugin_package.secret_binding.transition' as const;
|
||||
export const PLUGIN_PACKAGE_SECRET_BINDING_TRANSITION_PERMISSION =
|
||||
'secret.manage' as const;
|
||||
export const MAX_PLUGIN_PACKAGE_SECRET_BINDING_TRANSITION_APPROVAL_PLAN_LIFETIME_MS =
|
||||
15 * 60 * 1000;
|
||||
export const MAX_PLUGIN_PACKAGE_SECRET_BINDING_TRANSITION_APPROVAL_PLAN_JSON_BYTES =
|
||||
224 * 1024;
|
||||
|
||||
export interface PluginPackageSecretBindingTransitionApprovalPlan {
|
||||
readonly schema: typeof PLUGIN_PACKAGE_SECRET_BINDING_TRANSITION_APPROVAL_PLAN_SCHEMA;
|
||||
readonly actionRef: string;
|
||||
readonly transitionPlan: Readonly<PluginPackageSecretBindingTransitionPlan>;
|
||||
readonly requestedBy: Readonly<SecuritySubject>;
|
||||
readonly plannedAtMs: number;
|
||||
readonly expiresAtMs: number;
|
||||
readonly approvalPlanDigest: string;
|
||||
}
|
||||
|
||||
export interface CreatePluginPackageSecretBindingTransitionApprovalPlanInput {
|
||||
readonly actionRef: string;
|
||||
readonly transitionPlan: Readonly<PluginPackageSecretBindingTransitionPlan>;
|
||||
readonly requestedBy: SecuritySubject;
|
||||
readonly plannedAtMs: number;
|
||||
readonly expiresAtMs: number;
|
||||
}
|
||||
|
||||
export interface CreatePluginPackageSecretBindingTransitionApprovalPlanResult {
|
||||
readonly status: 'created' | 'existing';
|
||||
readonly plan: Readonly<PluginPackageSecretBindingTransitionApprovalPlan>;
|
||||
}
|
||||
|
||||
export interface PluginPackageSecretBindingTransitionApprovalPlanRepository {
|
||||
create(
|
||||
plan: Readonly<PluginPackageSecretBindingTransitionApprovalPlan>,
|
||||
): Promise<
|
||||
Readonly<CreatePluginPackageSecretBindingTransitionApprovalPlanResult>
|
||||
>;
|
||||
findByActionRef(
|
||||
actionRef: string,
|
||||
): Promise<Readonly<PluginPackageSecretBindingTransitionApprovalPlan> | null>;
|
||||
}
|
||||
|
||||
export class InvalidPluginPackageSecretBindingTransitionApprovalPlanError extends TypeError {
|
||||
readonly code =
|
||||
'PLUGIN_PACKAGE_SECRET_BINDING_TRANSITION_APPROVAL_PLAN_INVALID';
|
||||
|
||||
constructor(message: string) {
|
||||
super(
|
||||
`Plugin Package Secret binding transition approval plan is invalid: ${message}`,
|
||||
);
|
||||
this.name =
|
||||
'InvalidPluginPackageSecretBindingTransitionApprovalPlanError';
|
||||
}
|
||||
}
|
||||
|
||||
export class PluginPackageSecretBindingTransitionApprovalPlanConflictError extends Error {
|
||||
readonly code =
|
||||
'PLUGIN_PACKAGE_SECRET_BINDING_TRANSITION_APPROVAL_PLAN_CONFLICT';
|
||||
|
||||
constructor(message: string) {
|
||||
super(
|
||||
`Plugin Package Secret binding transition approval plan conflicts with durable state: ${message}`,
|
||||
);
|
||||
this.name =
|
||||
'PluginPackageSecretBindingTransitionApprovalPlanConflictError';
|
||||
}
|
||||
}
|
||||
|
||||
export class PluginPackageSecretBindingTransitionApprovalPlanUnavailableError extends Error {
|
||||
readonly code =
|
||||
'PLUGIN_PACKAGE_SECRET_BINDING_TRANSITION_APPROVAL_PLAN_UNAVAILABLE';
|
||||
|
||||
constructor(options?: ErrorOptions) {
|
||||
super(
|
||||
'Plugin Package Secret binding transition approval plan is unavailable',
|
||||
options,
|
||||
);
|
||||
this.name =
|
||||
'PluginPackageSecretBindingTransitionApprovalPlanUnavailableError';
|
||||
}
|
||||
}
|
||||
|
||||
const ACTION_REF_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,254}$/;
|
||||
const SUBJECT_CONTROL_PATTERN = /[\u0000-\u001f\u007f]/;
|
||||
const DIGEST_PATTERN = /^[0-9a-f]{64}$/;
|
||||
const APPROVAL_PLAN_DIGEST_DOMAIN = Buffer.from(
|
||||
'qinglong/plugin-package-secret-binding-transition-approval-plan-digest@v1\0',
|
||||
'utf8',
|
||||
);
|
||||
|
||||
function invalid(message: string): never {
|
||||
throw new InvalidPluginPackageSecretBindingTransitionApprovalPlanError(
|
||||
message,
|
||||
);
|
||||
}
|
||||
|
||||
function record(value: unknown, label: string): Record<string, unknown> {
|
||||
if (
|
||||
!value ||
|
||||
typeof value !== 'object' ||
|
||||
Array.isArray(value) ||
|
||||
(Object.getPrototypeOf(value) !== Object.prototype &&
|
||||
Object.getPrototypeOf(value) !== null)
|
||||
) {
|
||||
return invalid(`${label} must be an object`);
|
||||
}
|
||||
const descriptors = Object.getOwnPropertyDescriptors(value);
|
||||
if (
|
||||
Object.values(descriptors).some(
|
||||
(descriptor) =>
|
||||
descriptor.get !== undefined ||
|
||||
descriptor.set !== undefined ||
|
||||
descriptor.enumerable !== true,
|
||||
)
|
||||
) {
|
||||
return invalid(`${label} must contain enumerable data properties`);
|
||||
}
|
||||
return value as Record<string, unknown>;
|
||||
}
|
||||
|
||||
function exactKeys(
|
||||
value: object,
|
||||
expected: readonly string[],
|
||||
label: string,
|
||||
): void {
|
||||
const keys = Reflect.ownKeys(value);
|
||||
const canonical = [...expected].sort();
|
||||
if (
|
||||
keys.some((key) => typeof key !== 'string') ||
|
||||
keys.length !== canonical.length ||
|
||||
keys
|
||||
.map(String)
|
||||
.sort()
|
||||
.some((key, index) => key !== canonical[index])
|
||||
) {
|
||||
invalid(`${label} shape is invalid`);
|
||||
}
|
||||
}
|
||||
|
||||
function actionRef(value: unknown): string {
|
||||
if (typeof value !== 'string' || !ACTION_REF_PATTERN.test(value)) {
|
||||
return invalid('actionRef is invalid');
|
||||
}
|
||||
return value;
|
||||
}
|
||||
|
||||
function timestamp(value: unknown, label: string): number {
|
||||
if (!Number.isSafeInteger(value) || (value as number) < 0) {
|
||||
return invalid(`${label} is invalid`);
|
||||
}
|
||||
return value as number;
|
||||
}
|
||||
|
||||
function requestedBy(value: SecuritySubject): Readonly<SecuritySubject> {
|
||||
const candidate = record(value, 'requestedBy');
|
||||
exactKeys(candidate, ['id', 'type'], 'requestedBy');
|
||||
if (
|
||||
value.type !== 'user' ||
|
||||
typeof value.id !== 'string' ||
|
||||
value.id.length < 1 ||
|
||||
Buffer.byteLength(value.id, 'utf8') > 255 ||
|
||||
SUBJECT_CONTROL_PATTERN.test(value.id)
|
||||
) {
|
||||
return invalid('requestedBy must be a User subject');
|
||||
}
|
||||
return Object.freeze({ type: 'user', id: value.id });
|
||||
}
|
||||
|
||||
function unsigned(
|
||||
value: Omit<
|
||||
PluginPackageSecretBindingTransitionApprovalPlan,
|
||||
'approvalPlanDigest'
|
||||
>,
|
||||
): Omit<
|
||||
PluginPackageSecretBindingTransitionApprovalPlan,
|
||||
'approvalPlanDigest'
|
||||
> {
|
||||
if (
|
||||
value.schema !==
|
||||
PLUGIN_PACKAGE_SECRET_BINDING_TRANSITION_APPROVAL_PLAN_SCHEMA
|
||||
) {
|
||||
return invalid('schema is invalid');
|
||||
}
|
||||
const transitionPlan =
|
||||
normalizePluginPackageSecretBindingTransitionPlan(value.transitionPlan);
|
||||
const plannedAtMs = timestamp(value.plannedAtMs, 'plannedAtMs');
|
||||
const expiresAtMs = timestamp(value.expiresAtMs, 'expiresAtMs');
|
||||
if (
|
||||
expiresAtMs <= plannedAtMs ||
|
||||
expiresAtMs - plannedAtMs >
|
||||
MAX_PLUGIN_PACKAGE_SECRET_BINDING_TRANSITION_APPROVAL_PLAN_LIFETIME_MS ||
|
||||
(transitionPlan.nextBindingPlan !== null &&
|
||||
transitionPlan.nextBindingPlan.plannedAtMs !== plannedAtMs)
|
||||
) {
|
||||
return invalid('lifetime is invalid');
|
||||
}
|
||||
return Object.freeze({
|
||||
schema:
|
||||
PLUGIN_PACKAGE_SECRET_BINDING_TRANSITION_APPROVAL_PLAN_SCHEMA,
|
||||
actionRef: actionRef(value.actionRef),
|
||||
transitionPlan,
|
||||
requestedBy: requestedBy(value.requestedBy),
|
||||
plannedAtMs,
|
||||
expiresAtMs,
|
||||
});
|
||||
}
|
||||
|
||||
function approvalPlanDigest(
|
||||
value: Omit<
|
||||
PluginPackageSecretBindingTransitionApprovalPlan,
|
||||
'approvalPlanDigest'
|
||||
>,
|
||||
): string {
|
||||
return createHash('sha256')
|
||||
.update(APPROVAL_PLAN_DIGEST_DOMAIN)
|
||||
.update(JSON.stringify(value), 'utf8')
|
||||
.digest('hex');
|
||||
}
|
||||
|
||||
function bounded(
|
||||
value: Readonly<PluginPackageSecretBindingTransitionApprovalPlan>,
|
||||
): Readonly<PluginPackageSecretBindingTransitionApprovalPlan> {
|
||||
if (
|
||||
Buffer.byteLength(JSON.stringify(value), 'utf8') >
|
||||
MAX_PLUGIN_PACKAGE_SECRET_BINDING_TRANSITION_APPROVAL_PLAN_JSON_BYTES
|
||||
) {
|
||||
return invalid('encoded plan exceeds the size limit');
|
||||
}
|
||||
return value;
|
||||
}
|
||||
|
||||
export function createPluginPackageSecretBindingTransitionApprovalPlan(
|
||||
input: CreatePluginPackageSecretBindingTransitionApprovalPlanInput,
|
||||
): Readonly<PluginPackageSecretBindingTransitionApprovalPlan> {
|
||||
const candidate = record(input, 'approval plan input');
|
||||
exactKeys(
|
||||
candidate,
|
||||
[
|
||||
'actionRef',
|
||||
'expiresAtMs',
|
||||
'plannedAtMs',
|
||||
'requestedBy',
|
||||
'transitionPlan',
|
||||
],
|
||||
'approval plan input',
|
||||
);
|
||||
const normalized = unsigned({
|
||||
schema:
|
||||
PLUGIN_PACKAGE_SECRET_BINDING_TRANSITION_APPROVAL_PLAN_SCHEMA,
|
||||
actionRef: input.actionRef,
|
||||
transitionPlan: input.transitionPlan,
|
||||
requestedBy: input.requestedBy,
|
||||
plannedAtMs: input.plannedAtMs,
|
||||
expiresAtMs: input.expiresAtMs,
|
||||
});
|
||||
return bounded(
|
||||
Object.freeze({
|
||||
...normalized,
|
||||
approvalPlanDigest: approvalPlanDigest(normalized),
|
||||
}),
|
||||
);
|
||||
}
|
||||
|
||||
export function normalizePluginPackageSecretBindingTransitionApprovalPlan(
|
||||
value: PluginPackageSecretBindingTransitionApprovalPlan,
|
||||
): Readonly<PluginPackageSecretBindingTransitionApprovalPlan> {
|
||||
const candidate = record(value, 'approval plan');
|
||||
exactKeys(
|
||||
candidate,
|
||||
[
|
||||
'actionRef',
|
||||
'approvalPlanDigest',
|
||||
'expiresAtMs',
|
||||
'plannedAtMs',
|
||||
'requestedBy',
|
||||
'schema',
|
||||
'transitionPlan',
|
||||
],
|
||||
'approval plan',
|
||||
);
|
||||
const normalized = unsigned(value);
|
||||
const digest = approvalPlanDigest(normalized);
|
||||
if (
|
||||
typeof value.approvalPlanDigest !== 'string' ||
|
||||
!DIGEST_PATTERN.test(value.approvalPlanDigest) ||
|
||||
value.approvalPlanDigest !== digest
|
||||
) {
|
||||
return invalid('approvalPlanDigest does not match approval plan');
|
||||
}
|
||||
return bounded(Object.freeze({ ...normalized, approvalPlanDigest: digest }));
|
||||
}
|
||||
|
||||
export function pluginPackageSecretBindingTransitionApprovedAction(
|
||||
value: PluginPackageSecretBindingTransitionApprovalPlan,
|
||||
): Readonly<ApprovedActionBinding> {
|
||||
const plan = normalizePluginPackageSecretBindingTransitionApprovalPlan(value);
|
||||
return Object.freeze({
|
||||
permission: PLUGIN_PACKAGE_SECRET_BINDING_TRANSITION_PERMISSION,
|
||||
actionType: PLUGIN_PACKAGE_SECRET_BINDING_TRANSITION_ACTION_TYPE,
|
||||
actionRef: plan.actionRef,
|
||||
actionDigest: plan.approvalPlanDigest,
|
||||
previewDigest: plan.transitionPlan.transitionDigest,
|
||||
});
|
||||
}
|
||||
+154
@@ -0,0 +1,154 @@
|
||||
'use strict';
|
||||
|
||||
const assert = require('node:assert/strict');
|
||||
const { test } = require('node:test');
|
||||
|
||||
const {
|
||||
createPluginPackageSecretBinding,
|
||||
} = require('@qinglong/runtime-core/plugin-package-secret-binding');
|
||||
const {
|
||||
createPluginPackageResourceGeneration,
|
||||
} = require('@qinglong/runtime-core/plugin-package-resource-generation');
|
||||
const { createSecretRef } = require('@qinglong/runtime-core/secret-reference');
|
||||
const {
|
||||
createPluginPackageSecretBindingTransitionPlan,
|
||||
} = require('@qinglong/runtime-core/plugin-package-secret-binding-transition-plan');
|
||||
const {
|
||||
createPluginPackageSecretBindingTransitionApprovalPlan,
|
||||
normalizePluginPackageSecretBindingTransitionApprovalPlan,
|
||||
pluginPackageSecretBindingTransitionApprovedAction,
|
||||
} = require('@qinglong/runtime-core/plugin-package-secret-binding-transition-approval-plan');
|
||||
|
||||
function manifest(version = '2.0.0') {
|
||||
return {
|
||||
apiVersion: 'qinglong.io/v1alpha1',
|
||||
kind: 'Package',
|
||||
metadata: {
|
||||
name: 'example-monitor',
|
||||
displayName: 'Example Monitor',
|
||||
version,
|
||||
description: 'transition approval fixture',
|
||||
license: 'Apache-2.0',
|
||||
},
|
||||
spec: {
|
||||
compatibility: {
|
||||
qinglong: '>=3.0.0-0 <4.0.0',
|
||||
architectures: ['arm64'],
|
||||
deploymentProfiles: ['cluster-control'],
|
||||
},
|
||||
runtimes: [],
|
||||
resources: {
|
||||
memory: { recommended: '32Mi' },
|
||||
disk: { install: '4Mi', working: '8Mi' },
|
||||
},
|
||||
permissions: {
|
||||
network: { allowedHosts: [] },
|
||||
secrets: [{ name: 'TOKEN', required: true }],
|
||||
tools: ['secret.use'],
|
||||
},
|
||||
contents: { tasks: [], workflows: [], prompts: [], tools: [] },
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
function transition() {
|
||||
const previousManifest = manifest('1.0.0');
|
||||
const previousGeneration = createPluginPackageResourceGeneration({
|
||||
installationId: 'install-v1',
|
||||
projectId: 'project-1',
|
||||
packageName: 'example-monitor',
|
||||
lockDigest: 'a'.repeat(64),
|
||||
generation: 1,
|
||||
previousActiveLockDigest: null,
|
||||
contentDigest: 'b'.repeat(64),
|
||||
contents: previousManifest.spec.contents,
|
||||
});
|
||||
const previousBinding = createPluginPackageSecretBinding({
|
||||
generation: previousGeneration,
|
||||
manifest: previousManifest,
|
||||
assignments: [{
|
||||
name: 'TOKEN',
|
||||
secretRef: createSecretRef({
|
||||
projectId: 'project-1',
|
||||
name: 'runtime-token',
|
||||
version: 1,
|
||||
}),
|
||||
}],
|
||||
authority: {
|
||||
kind: 'approved-action-execution',
|
||||
evidenceDigest: 'c'.repeat(64),
|
||||
},
|
||||
boundAtMs: 80,
|
||||
});
|
||||
return createPluginPackageSecretBindingTransitionPlan({
|
||||
previousTarget: previousBinding.target,
|
||||
previousBinding,
|
||||
previousAttemptGeneration: 1,
|
||||
nextGeneration: createPluginPackageResourceGeneration({
|
||||
installationId: 'install-v2',
|
||||
projectId: 'project-1',
|
||||
packageName: 'example-monitor',
|
||||
lockDigest: 'd'.repeat(64),
|
||||
generation: 2,
|
||||
previousActiveLockDigest: 'a'.repeat(64),
|
||||
contentDigest: 'e'.repeat(64),
|
||||
contents: manifest().spec.contents,
|
||||
}),
|
||||
nextManifest: manifest(),
|
||||
assignments: [{
|
||||
name: 'TOKEN',
|
||||
secretRef: createSecretRef({
|
||||
projectId: 'project-1',
|
||||
name: 'runtime-token',
|
||||
version: 2,
|
||||
}),
|
||||
}],
|
||||
plannedAtMs: 100,
|
||||
});
|
||||
}
|
||||
|
||||
test('binds one transition to an immutable separation-of-duty action', () => {
|
||||
const plan = createPluginPackageSecretBindingTransitionApprovalPlan({
|
||||
actionRef: 'secret-transition:example-monitor-v2',
|
||||
transitionPlan: transition(),
|
||||
requestedBy: { type: 'user', id: 'cluster-owner' },
|
||||
plannedAtMs: 100,
|
||||
expiresAtMs: 1_000,
|
||||
});
|
||||
assert.deepEqual(
|
||||
normalizePluginPackageSecretBindingTransitionApprovalPlan(plan),
|
||||
plan,
|
||||
);
|
||||
assert.deepEqual(pluginPackageSecretBindingTransitionApprovedAction(plan), {
|
||||
permission: 'secret.manage',
|
||||
actionType: 'plugin_package.secret_binding.transition',
|
||||
actionRef: plan.actionRef,
|
||||
actionDigest: plan.approvalPlanDigest,
|
||||
previewDigest: plan.transitionPlan.transitionDigest,
|
||||
});
|
||||
});
|
||||
|
||||
test('rejects digest, lifetime and requester drift', () => {
|
||||
const plan = createPluginPackageSecretBindingTransitionApprovalPlan({
|
||||
actionRef: 'secret-transition:example-monitor-v2',
|
||||
transitionPlan: transition(),
|
||||
requestedBy: { type: 'user', id: 'cluster-owner' },
|
||||
plannedAtMs: 100,
|
||||
expiresAtMs: 1_000,
|
||||
});
|
||||
assert.throws(() =>
|
||||
normalizePluginPackageSecretBindingTransitionApprovalPlan({
|
||||
...plan,
|
||||
approvalPlanDigest: '9'.repeat(64),
|
||||
}),
|
||||
);
|
||||
assert.throws(() =>
|
||||
createPluginPackageSecretBindingTransitionApprovalPlan({
|
||||
actionRef: plan.actionRef,
|
||||
transitionPlan: plan.transitionPlan,
|
||||
requestedBy: { type: 'system', id: 'cluster-control' },
|
||||
plannedAtMs: 100,
|
||||
expiresAtMs: 1_000,
|
||||
}),
|
||||
);
|
||||
});
|
||||
Reference in New Issue
Block a user