mirror of
https://github.com/whyour/qinglong.git
synced 2026-09-21 18:08:20 +08:00
feat(ql3): apply legacy data transformation
This commit is contained in:
whyour
+994
@@ -0,0 +1,994 @@
|
||||
import { createHash } from 'node:crypto';
|
||||
import type { DatabaseSync } from 'node:sqlite';
|
||||
|
||||
import {
|
||||
createLocalSecretRef,
|
||||
normalizeLocalSecretEnvelope,
|
||||
type LocalSecretEnvelope,
|
||||
} from '@qinglong/runtime-core/local-secret';
|
||||
import {
|
||||
normalizeProjectPolicySubject,
|
||||
type ProjectPolicyRepository,
|
||||
} from '@qinglong/runtime-core/project-policy';
|
||||
import type {
|
||||
SecurityPolicyFence,
|
||||
SecuritySubject,
|
||||
} from '@qinglong/runtime-core/security';
|
||||
import {
|
||||
normalizeSecurityAuditRecord,
|
||||
type SecurityAuditRecord,
|
||||
type SecurityAuditSink,
|
||||
} from '@qinglong/runtime-core/security-audit';
|
||||
|
||||
import { LocalSqliteOperationAuthority } from '../../authority/operationAuthority';
|
||||
import {
|
||||
auditLocalSqliteReadiness,
|
||||
type LocalSqliteReadinessEvidence,
|
||||
} from '../../readiness/readiness';
|
||||
import { LocalSqliteSecurityAuthorityStore } from '../../security/securityAuthorityStore';
|
||||
import {
|
||||
assertLocalSqliteOptions,
|
||||
assertLocalSqlitePathBoundary,
|
||||
openLocalSqliteClient,
|
||||
type LocalSqliteDatabaseOptions,
|
||||
type LocalSqliteProfile,
|
||||
} from '../../storage/config';
|
||||
|
||||
const DIGEST_PATTERN = /^[0-9a-f]{64}$/;
|
||||
const UUID_V4_PATTERN =
|
||||
/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
|
||||
const VALUE_FILE_PATTERN = /^secret-values\/[0-9a-f]{64}\.json$/;
|
||||
|
||||
export interface LocalDataDirectoryAppliedModel {
|
||||
readonly schema: 'qinglong/legacy-data-directory-applied-model@v1';
|
||||
readonly activation: 'disabled';
|
||||
readonly config: Readonly<Record<string, unknown>>;
|
||||
readonly keyv: Readonly<Record<string, unknown>>;
|
||||
readonly ssh: Readonly<Record<string, unknown>>;
|
||||
readonly manualReview: Readonly<Record<string, unknown>>;
|
||||
}
|
||||
|
||||
export interface LocalDataDirectoryAdoptionSecretPublication {
|
||||
readonly ordinal: number;
|
||||
readonly kind: 'environment' | 'ssh_private_key';
|
||||
readonly sourceNameDigest: string;
|
||||
readonly valueFile: string;
|
||||
readonly valueDigest: string;
|
||||
readonly envelope: Readonly<LocalSecretEnvelope>;
|
||||
readonly secretRef: string;
|
||||
readonly itemDigest: string;
|
||||
readonly audit: Readonly<SecurityAuditRecord>;
|
||||
}
|
||||
|
||||
export interface LocalDataDirectoryAdoptionSecretRecord {
|
||||
readonly ordinal: number;
|
||||
readonly kind: 'environment' | 'ssh_private_key';
|
||||
readonly sourceNameDigest: string;
|
||||
readonly secretName: string;
|
||||
readonly secretVersion: 1;
|
||||
readonly secretMutationId: string;
|
||||
readonly valueFile: string;
|
||||
readonly valueDigest: string;
|
||||
readonly secretRef: string;
|
||||
readonly itemDigest: string;
|
||||
}
|
||||
|
||||
export interface LocalDataDirectoryAdoptionReceiptPayload {
|
||||
readonly schema: 'qinglong/legacy-data-directory-adoption-receipt@v1';
|
||||
readonly mutationId: string;
|
||||
readonly projectId: string;
|
||||
readonly profile: LocalSqliteProfile;
|
||||
readonly sourceStageManifestDigest: string;
|
||||
readonly transformationDigest: string;
|
||||
readonly modelDigest: string;
|
||||
readonly secretCount: number;
|
||||
readonly environmentSecretCount: number;
|
||||
readonly sshSecretCount: number;
|
||||
readonly items: readonly Readonly<{
|
||||
ordinal: number;
|
||||
kind: LocalDataDirectoryAdoptionSecretRecord['kind'];
|
||||
sourceNameDigest: string;
|
||||
secretRef: string;
|
||||
valueFile: string;
|
||||
valueDigest: string;
|
||||
itemDigest: string;
|
||||
}>[];
|
||||
readonly publicationDigest: string;
|
||||
readonly auditEventId: string;
|
||||
readonly committedAtMs: number;
|
||||
}
|
||||
|
||||
export interface LocalDataDirectoryAdoptionReceipt
|
||||
extends LocalDataDirectoryAdoptionReceiptPayload {
|
||||
readonly receiptDigest: string;
|
||||
}
|
||||
|
||||
export interface LocalDataDirectoryAdoptionRecord {
|
||||
readonly mutationId: string;
|
||||
readonly projectId: string;
|
||||
readonly profile: LocalSqliteProfile;
|
||||
readonly sourceStageManifestDigest: string;
|
||||
readonly transformationDigest: string;
|
||||
readonly modelDigest: string;
|
||||
readonly model: Readonly<LocalDataDirectoryAppliedModel>;
|
||||
readonly publicationDigest: string;
|
||||
readonly auditEventId: string;
|
||||
readonly committedAtMs: number;
|
||||
readonly receiptDigest: string;
|
||||
readonly receipt: Readonly<LocalDataDirectoryAdoptionReceipt>;
|
||||
readonly secrets: readonly Readonly<LocalDataDirectoryAdoptionSecretRecord>[];
|
||||
}
|
||||
|
||||
export interface PublishLocalDataDirectoryAdoptionCommand {
|
||||
readonly mutationId: string;
|
||||
readonly projectId: string;
|
||||
readonly profile: LocalSqliteProfile;
|
||||
readonly sourceStageManifestDigest: string;
|
||||
readonly transformationDigest: string;
|
||||
readonly modelDigest: string;
|
||||
readonly model: Readonly<LocalDataDirectoryAppliedModel>;
|
||||
readonly subject: Readonly<SecuritySubject>;
|
||||
readonly fence: Readonly<SecurityPolicyFence>;
|
||||
readonly audit: Readonly<SecurityAuditRecord>;
|
||||
readonly secrets: readonly Readonly<LocalDataDirectoryAdoptionSecretPublication>[];
|
||||
readonly receipt: Readonly<LocalDataDirectoryAdoptionReceipt>;
|
||||
readonly confirmExternalAuthority: () => void | Promise<void>;
|
||||
}
|
||||
|
||||
export interface PublishLocalDataDirectoryAdoptionResult {
|
||||
readonly status: 'inserted' | 'existing';
|
||||
readonly adoption: Readonly<LocalDataDirectoryAdoptionRecord>;
|
||||
}
|
||||
|
||||
export class LocalDataDirectoryAdoptionConflictError extends Error {
|
||||
readonly code = 'LOCAL_DATA_DIRECTORY_ADOPTION_CONFLICT';
|
||||
|
||||
constructor() {
|
||||
super('Local data directory adoption conflicts with durable state');
|
||||
this.name = 'LocalDataDirectoryAdoptionConflictError';
|
||||
}
|
||||
}
|
||||
|
||||
export class LocalDataDirectoryAdoptionAuthorizationFenceConflictError extends Error {
|
||||
readonly code = 'LOCAL_DATA_DIRECTORY_ADOPTION_AUTHORIZATION_FENCE_CONFLICT';
|
||||
|
||||
constructor() {
|
||||
super('Local data directory adoption authorization fence changed');
|
||||
this.name = 'LocalDataDirectoryAdoptionAuthorizationFenceConflictError';
|
||||
}
|
||||
}
|
||||
|
||||
export class LocalDataDirectoryAdoptionUnavailableError extends Error {
|
||||
readonly code = 'LOCAL_DATA_DIRECTORY_ADOPTION_UNAVAILABLE';
|
||||
|
||||
constructor(readonly cause?: unknown) {
|
||||
super('Local data directory adoption storage is unavailable');
|
||||
this.name = 'LocalDataDirectoryAdoptionUnavailableError';
|
||||
}
|
||||
}
|
||||
|
||||
type Row = Record<string, unknown>;
|
||||
|
||||
function sha256(domain: string, value: string): string {
|
||||
return createHash('sha256')
|
||||
.update(domain, 'utf8')
|
||||
.update(value, 'utf8')
|
||||
.digest('hex');
|
||||
}
|
||||
|
||||
function exactKeys(value: object, expected: readonly string[]): boolean {
|
||||
const actual = Object.keys(value).sort();
|
||||
const canonical = [...expected].sort();
|
||||
return (
|
||||
actual.length === canonical.length &&
|
||||
actual.every((key, index) => key === canonical[index])
|
||||
);
|
||||
}
|
||||
|
||||
function safeInteger(value: unknown, minimum = 0): value is number {
|
||||
return Number.isSafeInteger(value) && (value as number) >= minimum;
|
||||
}
|
||||
|
||||
function text(row: Row, key: string): string {
|
||||
const value = row[key];
|
||||
if (typeof value !== 'string') {
|
||||
throw new LocalDataDirectoryAdoptionUnavailableError();
|
||||
}
|
||||
return value;
|
||||
}
|
||||
|
||||
function integer(row: Row, key: string): number {
|
||||
const value = row[key];
|
||||
if (!Number.isSafeInteger(value)) {
|
||||
throw new LocalDataDirectoryAdoptionUnavailableError();
|
||||
}
|
||||
return value as number;
|
||||
}
|
||||
|
||||
function json(row: Row, key: string): unknown {
|
||||
try {
|
||||
return JSON.parse(text(row, key));
|
||||
} catch (error) {
|
||||
throw new LocalDataDirectoryAdoptionUnavailableError(error);
|
||||
}
|
||||
}
|
||||
|
||||
function assertModel(
|
||||
value: unknown,
|
||||
): asserts value is LocalDataDirectoryAppliedModel {
|
||||
if (
|
||||
!value ||
|
||||
typeof value !== 'object' ||
|
||||
Array.isArray(value) ||
|
||||
!exactKeys(value, [
|
||||
'activation',
|
||||
'config',
|
||||
'keyv',
|
||||
'manualReview',
|
||||
'schema',
|
||||
'ssh',
|
||||
])
|
||||
) {
|
||||
throw new LocalDataDirectoryAdoptionConflictError();
|
||||
}
|
||||
const model = value as Record<string, unknown>;
|
||||
const entries = [model.config, model.keyv, model.ssh, model.manualReview];
|
||||
if (
|
||||
model.schema !== 'qinglong/legacy-data-directory-applied-model@v1' ||
|
||||
model.activation !== 'disabled' ||
|
||||
entries.some(
|
||||
(entry) => !entry || typeof entry !== 'object' || Array.isArray(entry),
|
||||
) ||
|
||||
(model.config as Row).schema !==
|
||||
'qinglong/legacy-config-transformation@v1' ||
|
||||
(model.config as Row).activation !== 'disabled' ||
|
||||
(model.keyv as Row).schema !== 'qinglong/legacy-keyv-transformation@v1' ||
|
||||
(model.keyv as Row).activation !== 'disabled' ||
|
||||
(model.ssh as Row).schema !== 'qinglong/legacy-ssh-transformation@v1' ||
|
||||
(model.ssh as Row).activation !== 'disabled' ||
|
||||
(model.manualReview as Row).schema !==
|
||||
'qinglong/legacy-data-directory-manual-review@v1' ||
|
||||
(model.manualReview as Row).required !== false ||
|
||||
(model.manualReview as Row).activation !== 'disabled' ||
|
||||
Buffer.byteLength(JSON.stringify(value), 'utf8') > 1024 * 1024
|
||||
) {
|
||||
throw new LocalDataDirectoryAdoptionConflictError();
|
||||
}
|
||||
}
|
||||
|
||||
function itemSemantic(
|
||||
item: Omit<LocalDataDirectoryAdoptionSecretRecord, 'itemDigest'>,
|
||||
): string {
|
||||
return JSON.stringify(item);
|
||||
}
|
||||
|
||||
export function createLocalDataDirectorySourceNameDigest(
|
||||
kind: LocalDataDirectoryAdoptionSecretRecord['kind'],
|
||||
sourceName: string,
|
||||
): string {
|
||||
if (
|
||||
(kind !== 'environment' && kind !== 'ssh_private_key') ||
|
||||
typeof sourceName !== 'string' ||
|
||||
sourceName.length < 1 ||
|
||||
sourceName.includes('\0')
|
||||
) {
|
||||
throw new LocalDataDirectoryAdoptionConflictError();
|
||||
}
|
||||
return createHash('sha256')
|
||||
.update('qinglong3.legacy-data-directory-source-name.v1\0')
|
||||
.update(kind)
|
||||
.update('\0')
|
||||
.update(sourceName)
|
||||
.digest('hex');
|
||||
}
|
||||
|
||||
export function createLocalDataDirectoryAdoptionSecretItem(options: {
|
||||
readonly projectId: string;
|
||||
readonly ordinal: number;
|
||||
readonly kind: LocalDataDirectoryAdoptionSecretRecord['kind'];
|
||||
readonly sourceNameDigest: string;
|
||||
readonly secretName: string;
|
||||
readonly secretMutationId: string;
|
||||
readonly valueFile: string;
|
||||
readonly valueDigest: string;
|
||||
}): Readonly<LocalDataDirectoryAdoptionSecretRecord> {
|
||||
return createSecretRecord(options);
|
||||
}
|
||||
|
||||
function createSecretRecord(options: {
|
||||
readonly projectId: string;
|
||||
readonly ordinal: number;
|
||||
readonly kind: LocalDataDirectoryAdoptionSecretRecord['kind'];
|
||||
readonly sourceNameDigest: string;
|
||||
readonly secretName: string;
|
||||
readonly secretMutationId: string;
|
||||
readonly valueFile: string;
|
||||
readonly valueDigest: string;
|
||||
}): Readonly<LocalDataDirectoryAdoptionSecretRecord> {
|
||||
const secretRef = createLocalSecretRef({
|
||||
projectId: options.projectId,
|
||||
name: options.secretName,
|
||||
version: 1,
|
||||
});
|
||||
const semantic = Object.freeze({
|
||||
ordinal: options.ordinal,
|
||||
kind: options.kind,
|
||||
sourceNameDigest: options.sourceNameDigest,
|
||||
secretName: options.secretName,
|
||||
secretVersion: 1 as const,
|
||||
secretMutationId: options.secretMutationId,
|
||||
valueFile: options.valueFile,
|
||||
valueDigest: options.valueDigest,
|
||||
secretRef,
|
||||
});
|
||||
return Object.freeze({
|
||||
...semantic,
|
||||
itemDigest: sha256(
|
||||
'qinglong3.legacy-data-directory-adoption-secret-item.v1\0',
|
||||
itemSemantic(semantic),
|
||||
),
|
||||
});
|
||||
}
|
||||
|
||||
function publicationDigest(options: {
|
||||
readonly mutationId: string;
|
||||
readonly projectId: string;
|
||||
readonly sourceStageManifestDigest: string;
|
||||
readonly transformationDigest: string;
|
||||
readonly modelDigest: string;
|
||||
readonly secrets: readonly Readonly<LocalDataDirectoryAdoptionSecretRecord>[];
|
||||
}): string {
|
||||
const hash = createHash('sha256')
|
||||
.update('qinglong3.legacy-data-directory-adoption-publication.v1\0')
|
||||
.update(options.mutationId)
|
||||
.update('\0')
|
||||
.update(options.projectId)
|
||||
.update('\0')
|
||||
.update(options.sourceStageManifestDigest)
|
||||
.update('\0')
|
||||
.update(options.transformationDigest)
|
||||
.update('\0')
|
||||
.update(options.modelDigest);
|
||||
for (const item of options.secrets) hash.update('\0').update(item.itemDigest);
|
||||
return hash.digest('hex');
|
||||
}
|
||||
|
||||
export function createLocalDataDirectoryAdoptionReceipt(options: {
|
||||
readonly mutationId: string;
|
||||
readonly projectId: string;
|
||||
readonly profile: LocalSqliteProfile;
|
||||
readonly sourceStageManifestDigest: string;
|
||||
readonly transformationDigest: string;
|
||||
readonly modelDigest: string;
|
||||
readonly secrets: readonly Readonly<LocalDataDirectoryAdoptionSecretRecord>[];
|
||||
readonly committedAtMs: number;
|
||||
}): Readonly<LocalDataDirectoryAdoptionReceipt> {
|
||||
const environmentSecretCount = options.secrets.filter(
|
||||
({ kind }) => kind === 'environment',
|
||||
).length;
|
||||
const sshSecretCount = options.secrets.length - environmentSecretCount;
|
||||
const publication = publicationDigest(options);
|
||||
const payload: LocalDataDirectoryAdoptionReceiptPayload = {
|
||||
schema: 'qinglong/legacy-data-directory-adoption-receipt@v1',
|
||||
mutationId: options.mutationId,
|
||||
projectId: options.projectId,
|
||||
profile: options.profile,
|
||||
sourceStageManifestDigest: options.sourceStageManifestDigest,
|
||||
transformationDigest: options.transformationDigest,
|
||||
modelDigest: options.modelDigest,
|
||||
secretCount: options.secrets.length,
|
||||
environmentSecretCount,
|
||||
sshSecretCount,
|
||||
items: Object.freeze(
|
||||
options.secrets.map(
|
||||
({
|
||||
ordinal,
|
||||
kind,
|
||||
sourceNameDigest,
|
||||
secretRef,
|
||||
valueFile,
|
||||
valueDigest,
|
||||
itemDigest,
|
||||
}) =>
|
||||
Object.freeze({
|
||||
ordinal,
|
||||
kind,
|
||||
sourceNameDigest,
|
||||
secretRef,
|
||||
valueFile,
|
||||
valueDigest,
|
||||
itemDigest,
|
||||
}),
|
||||
),
|
||||
),
|
||||
publicationDigest: publication,
|
||||
auditEventId: options.mutationId,
|
||||
committedAtMs: options.committedAtMs,
|
||||
};
|
||||
return Object.freeze({
|
||||
...payload,
|
||||
receiptDigest: sha256(
|
||||
'qinglong3.legacy-data-directory-adoption-receipt.v1\0',
|
||||
JSON.stringify(payload),
|
||||
),
|
||||
});
|
||||
}
|
||||
|
||||
function sameJson(left: unknown, right: unknown): boolean {
|
||||
return JSON.stringify(left) === JSON.stringify(right);
|
||||
}
|
||||
|
||||
function parseRecord(
|
||||
client: DatabaseSync,
|
||||
row: Row,
|
||||
): LocalDataDirectoryAdoptionRecord {
|
||||
const profile = text(row, 'profile');
|
||||
if (profile !== 'edge' && profile !== 'standalone') {
|
||||
throw new LocalDataDirectoryAdoptionUnavailableError();
|
||||
}
|
||||
const mutationId = text(row, 'mutationId');
|
||||
const projectId = text(row, 'projectId');
|
||||
const model = json(row, 'modelJson');
|
||||
assertModel(model);
|
||||
const itemRows = client
|
||||
.prepare(
|
||||
`SELECT item."ordinal" AS "ordinal", item."kind" AS "kind",
|
||||
item."source_name_digest" AS "sourceNameDigest",
|
||||
item."secret_name" AS "secretName",
|
||||
item."secret_version" AS "secretVersion",
|
||||
item."secret_mutation_id" AS "secretMutationId",
|
||||
item."value_file" AS "valueFile",
|
||||
item."value_digest" AS "valueDigest",
|
||||
item."secret_ref" AS "secretRef",
|
||||
item."item_digest" AS "itemDigest"
|
||||
FROM "QingLong3LegacyDataDirectoryAdoptionSecrets" AS item
|
||||
JOIN "QingLong3LocalSecretEnvelopes" AS secret
|
||||
ON secret."project_id" = item."project_id"
|
||||
AND secret."secret_name" = item."secret_name"
|
||||
AND secret."version" = item."secret_version"
|
||||
AND secret."mutation_id" = item."secret_mutation_id"
|
||||
JOIN "QingLong3SecurityAuditEvents" AS audit
|
||||
ON audit."event_id" = item."secret_mutation_id"
|
||||
AND audit."project_id" = item."project_id"
|
||||
AND audit."operation_id" = 'secret.create'
|
||||
AND audit."outcome" = 'allowed'
|
||||
WHERE item."adoption_mutation_id" = ?
|
||||
ORDER BY item."ordinal"`,
|
||||
)
|
||||
.all(mutationId) as Row[];
|
||||
const secrets = Object.freeze(
|
||||
itemRows.map((item, index) => {
|
||||
const kind = text(item, 'kind');
|
||||
const candidate = createSecretRecord({
|
||||
projectId,
|
||||
ordinal: integer(item, 'ordinal'),
|
||||
kind:
|
||||
kind === 'environment' || kind === 'ssh_private_key'
|
||||
? kind
|
||||
: (() => {
|
||||
throw new LocalDataDirectoryAdoptionUnavailableError();
|
||||
})(),
|
||||
sourceNameDigest: text(item, 'sourceNameDigest'),
|
||||
secretName: text(item, 'secretName'),
|
||||
secretMutationId: text(item, 'secretMutationId'),
|
||||
valueFile: text(item, 'valueFile'),
|
||||
valueDigest: text(item, 'valueDigest'),
|
||||
});
|
||||
if (
|
||||
candidate.ordinal !== index + 1 ||
|
||||
candidate.secretVersion !== integer(item, 'secretVersion') ||
|
||||
candidate.secretRef !== text(item, 'secretRef') ||
|
||||
candidate.itemDigest !== text(item, 'itemDigest')
|
||||
) {
|
||||
throw new LocalDataDirectoryAdoptionUnavailableError();
|
||||
}
|
||||
return candidate;
|
||||
}),
|
||||
);
|
||||
const sourceStageManifestDigest = text(row, 'sourceStageManifestDigest');
|
||||
const transformationDigest = text(row, 'transformationDigest');
|
||||
const modelDigest = text(row, 'modelDigest');
|
||||
const committedAtMs = integer(row, 'committedAtMs');
|
||||
const receipt = createLocalDataDirectoryAdoptionReceipt({
|
||||
mutationId,
|
||||
projectId,
|
||||
profile,
|
||||
sourceStageManifestDigest,
|
||||
transformationDigest,
|
||||
modelDigest,
|
||||
secrets,
|
||||
committedAtMs,
|
||||
});
|
||||
const storedReceipt = json(row, 'receiptJson');
|
||||
if (
|
||||
secrets.length !== integer(row, 'secretCount') ||
|
||||
receipt.environmentSecretCount !== integer(row, 'environmentSecretCount') ||
|
||||
receipt.sshSecretCount !== integer(row, 'sshSecretCount') ||
|
||||
receipt.publicationDigest !== text(row, 'publicationDigest') ||
|
||||
receipt.auditEventId !== text(row, 'auditEventId') ||
|
||||
receipt.receiptDigest !== text(row, 'receiptDigest') ||
|
||||
!sameJson(receipt, storedReceipt)
|
||||
) {
|
||||
throw new LocalDataDirectoryAdoptionUnavailableError();
|
||||
}
|
||||
return Object.freeze({
|
||||
mutationId,
|
||||
projectId,
|
||||
profile,
|
||||
sourceStageManifestDigest,
|
||||
transformationDigest,
|
||||
modelDigest,
|
||||
model,
|
||||
publicationDigest: receipt.publicationDigest,
|
||||
auditEventId: receipt.auditEventId,
|
||||
committedAtMs,
|
||||
receiptDigest: receipt.receiptDigest,
|
||||
receipt,
|
||||
secrets,
|
||||
});
|
||||
}
|
||||
|
||||
const RECORD_SELECT = `
|
||||
adoption."mutation_id" AS "mutationId",
|
||||
adoption."project_id" AS "projectId",
|
||||
adoption."profile" AS "profile",
|
||||
adoption."source_stage_manifest_digest" AS "sourceStageManifestDigest",
|
||||
adoption."transformation_digest" AS "transformationDigest",
|
||||
adoption."model_digest" AS "modelDigest",
|
||||
adoption."secret_count" AS "secretCount",
|
||||
adoption."environment_secret_count" AS "environmentSecretCount",
|
||||
adoption."ssh_secret_count" AS "sshSecretCount",
|
||||
adoption."model_json" AS "modelJson",
|
||||
adoption."publication_digest" AS "publicationDigest",
|
||||
adoption."audit_event_id" AS "auditEventId",
|
||||
adoption."committed_at_ms" AS "committedAtMs",
|
||||
adoption."receipt_digest" AS "receiptDigest",
|
||||
adoption."receipt_json" AS "receiptJson"`;
|
||||
|
||||
function findRecord(
|
||||
client: DatabaseSync,
|
||||
mutationId: string,
|
||||
transformationDigest?: string,
|
||||
): LocalDataDirectoryAdoptionRecord | null {
|
||||
const rows = transformationDigest
|
||||
? (client
|
||||
.prepare(
|
||||
`SELECT ${RECORD_SELECT}
|
||||
FROM "QingLong3LegacyDataDirectoryAdoptions" AS adoption
|
||||
JOIN "QingLong3SecurityAuditEvents" AS audit
|
||||
ON audit."event_id" = adoption."audit_event_id"
|
||||
AND audit."project_id" = adoption."project_id"
|
||||
AND audit."operation_id" = 'legacy-data.apply'
|
||||
AND audit."outcome" = 'allowed'
|
||||
WHERE adoption."mutation_id" = ?
|
||||
OR adoption."transformation_digest" = ?
|
||||
LIMIT 2`,
|
||||
)
|
||||
.all(mutationId, transformationDigest) as Row[])
|
||||
: (client
|
||||
.prepare(
|
||||
`SELECT ${RECORD_SELECT}
|
||||
FROM "QingLong3LegacyDataDirectoryAdoptions" AS adoption
|
||||
JOIN "QingLong3SecurityAuditEvents" AS audit
|
||||
ON audit."event_id" = adoption."audit_event_id"
|
||||
AND audit."project_id" = adoption."project_id"
|
||||
AND audit."operation_id" = 'legacy-data.apply'
|
||||
AND audit."outcome" = 'allowed'
|
||||
WHERE adoption."mutation_id" = ?
|
||||
LIMIT 2`,
|
||||
)
|
||||
.all(mutationId) as Row[]);
|
||||
if (rows.length === 0) return null;
|
||||
if (rows.length !== 1) throw new LocalDataDirectoryAdoptionConflictError();
|
||||
return parseRecord(client, rows[0]!);
|
||||
}
|
||||
|
||||
function insertAudit(client: DatabaseSync, audit: SecurityAuditRecord): void {
|
||||
client
|
||||
.prepare(
|
||||
`INSERT INTO "QingLong3SecurityAuditEvents" (
|
||||
"event_id", "request_id", "operation_id", "project_id",
|
||||
"subject_type", "subject_id", "authentication_id", "outcome",
|
||||
"reasons_json", "fence_project_version", "fence_binding_version",
|
||||
"occurred_at_ms"
|
||||
) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
|
||||
)
|
||||
.run(
|
||||
audit.eventId,
|
||||
audit.requestId,
|
||||
audit.operationId,
|
||||
audit.projectId,
|
||||
audit.subject?.type ?? null,
|
||||
audit.subject?.id ?? null,
|
||||
audit.authenticationId,
|
||||
audit.outcome,
|
||||
JSON.stringify(audit.reasons),
|
||||
audit.fence?.projectVersion ?? null,
|
||||
audit.fence?.bindingVersion ?? null,
|
||||
audit.occurredAtMs,
|
||||
);
|
||||
}
|
||||
|
||||
function assertCommand(command: PublishLocalDataDirectoryAdoptionCommand): {
|
||||
readonly subject: Readonly<SecuritySubject>;
|
||||
readonly audit: Readonly<SecurityAuditRecord>;
|
||||
readonly secrets: readonly Readonly<{
|
||||
publication: LocalDataDirectoryAdoptionSecretPublication;
|
||||
record: LocalDataDirectoryAdoptionSecretRecord;
|
||||
envelope: LocalSecretEnvelope;
|
||||
audit: SecurityAuditRecord;
|
||||
}>[];
|
||||
} {
|
||||
if (
|
||||
!command ||
|
||||
typeof command !== 'object' ||
|
||||
!UUID_V4_PATTERN.test(command.mutationId) ||
|
||||
(command.profile !== 'edge' && command.profile !== 'standalone') ||
|
||||
![
|
||||
command.sourceStageManifestDigest,
|
||||
command.transformationDigest,
|
||||
command.modelDigest,
|
||||
].every((value) => DIGEST_PATTERN.test(value)) ||
|
||||
!Array.isArray(command.secrets) ||
|
||||
command.secrets.length > (command.profile === 'edge' ? 128 : 512) ||
|
||||
typeof command.confirmExternalAuthority !== 'function'
|
||||
) {
|
||||
throw new LocalDataDirectoryAdoptionConflictError();
|
||||
}
|
||||
assertModel(command.model);
|
||||
const subject = normalizeProjectPolicySubject(command.subject);
|
||||
const audit = normalizeSecurityAuditRecord(command.audit);
|
||||
if (
|
||||
!command.fence ||
|
||||
!safeInteger(command.fence.projectVersion, 1) ||
|
||||
!safeInteger(command.fence.bindingVersion, 1) ||
|
||||
audit.eventId !== command.mutationId ||
|
||||
audit.operationId !== 'legacy-data.apply' ||
|
||||
audit.projectId !== command.projectId ||
|
||||
audit.subject?.type !== subject.type ||
|
||||
audit.subject.id !== subject.id ||
|
||||
audit.outcome !== 'allowed' ||
|
||||
audit.fence?.projectVersion !== command.fence.projectVersion ||
|
||||
audit.fence.bindingVersion !== command.fence.bindingVersion ||
|
||||
audit.occurredAtMs !== command.receipt.committedAtMs
|
||||
) {
|
||||
throw new LocalDataDirectoryAdoptionConflictError();
|
||||
}
|
||||
const names = new Set<string>();
|
||||
const mutations = new Set<string>([command.mutationId]);
|
||||
const secrets = command.secrets.map((publication, index) => {
|
||||
const envelope = normalizeLocalSecretEnvelope(publication.envelope);
|
||||
const itemAudit = normalizeSecurityAuditRecord(publication.audit);
|
||||
const record = createSecretRecord({
|
||||
projectId: command.projectId,
|
||||
ordinal: publication.ordinal,
|
||||
kind: publication.kind,
|
||||
sourceNameDigest: publication.sourceNameDigest,
|
||||
secretName: envelope.name,
|
||||
secretMutationId: envelope.mutationId,
|
||||
valueFile: publication.valueFile,
|
||||
valueDigest: publication.valueDigest,
|
||||
});
|
||||
if (
|
||||
publication.ordinal !== index + 1 ||
|
||||
envelope.projectId !== command.projectId ||
|
||||
envelope.version !== 1 ||
|
||||
!UUID_V4_PATTERN.test(envelope.mutationId) ||
|
||||
names.has(envelope.name) ||
|
||||
mutations.has(envelope.mutationId) ||
|
||||
!DIGEST_PATTERN.test(publication.sourceNameDigest) ||
|
||||
!DIGEST_PATTERN.test(publication.valueDigest) ||
|
||||
!VALUE_FILE_PATTERN.test(publication.valueFile) ||
|
||||
publication.secretRef !== record.secretRef ||
|
||||
publication.itemDigest !== record.itemDigest ||
|
||||
itemAudit.eventId !== envelope.mutationId ||
|
||||
itemAudit.operationId !== 'secret.create' ||
|
||||
itemAudit.projectId !== command.projectId ||
|
||||
itemAudit.subject?.type !== subject.type ||
|
||||
itemAudit.subject.id !== subject.id ||
|
||||
itemAudit.outcome !== 'allowed' ||
|
||||
itemAudit.fence?.projectVersion !== command.fence.projectVersion ||
|
||||
itemAudit.fence.bindingVersion !== command.fence.bindingVersion ||
|
||||
itemAudit.occurredAtMs !== command.receipt.committedAtMs
|
||||
) {
|
||||
throw new LocalDataDirectoryAdoptionConflictError();
|
||||
}
|
||||
names.add(envelope.name);
|
||||
mutations.add(envelope.mutationId);
|
||||
return Object.freeze({ publication, record, envelope, audit: itemAudit });
|
||||
});
|
||||
const expectedReceipt = createLocalDataDirectoryAdoptionReceipt({
|
||||
mutationId: command.mutationId,
|
||||
projectId: command.projectId,
|
||||
profile: command.profile,
|
||||
sourceStageManifestDigest: command.sourceStageManifestDigest,
|
||||
transformationDigest: command.transformationDigest,
|
||||
modelDigest: command.modelDigest,
|
||||
secrets: secrets.map(({ record }) => record),
|
||||
committedAtMs: command.receipt.committedAtMs,
|
||||
});
|
||||
if (!sameJson(expectedReceipt, command.receipt)) {
|
||||
throw new LocalDataDirectoryAdoptionConflictError();
|
||||
}
|
||||
return Object.freeze({ subject, audit, secrets: Object.freeze(secrets) });
|
||||
}
|
||||
|
||||
function exactReplay(
|
||||
existing: Readonly<LocalDataDirectoryAdoptionRecord>,
|
||||
command: Readonly<PublishLocalDataDirectoryAdoptionCommand>,
|
||||
): boolean {
|
||||
return (
|
||||
existing.mutationId === command.mutationId &&
|
||||
existing.projectId === command.projectId &&
|
||||
existing.profile === command.profile &&
|
||||
existing.sourceStageManifestDigest === command.sourceStageManifestDigest &&
|
||||
existing.transformationDigest === command.transformationDigest &&
|
||||
existing.modelDigest === command.modelDigest &&
|
||||
sameJson(existing.model, command.model) &&
|
||||
sameJson(existing.receipt, command.receipt)
|
||||
);
|
||||
}
|
||||
|
||||
export class LocalSqliteDataDirectoryAdoptionPublisher {
|
||||
constructor(private readonly authority: LocalSqliteOperationAuthority) {}
|
||||
|
||||
resolve(
|
||||
mutationId: string,
|
||||
): Promise<Readonly<LocalDataDirectoryAdoptionRecord> | null> {
|
||||
if (!UUID_V4_PATTERN.test(mutationId)) {
|
||||
return Promise.reject(new LocalDataDirectoryAdoptionConflictError());
|
||||
}
|
||||
return this.authority.enqueue(
|
||||
async () => findRecord(this.authority.client, mutationId),
|
||||
() => new LocalDataDirectoryAdoptionUnavailableError(),
|
||||
);
|
||||
}
|
||||
|
||||
publish(
|
||||
command: Readonly<PublishLocalDataDirectoryAdoptionCommand>,
|
||||
): Promise<PublishLocalDataDirectoryAdoptionResult> {
|
||||
const normalized = assertCommand(command);
|
||||
return this.authority.enqueue(
|
||||
async () => {
|
||||
const client = this.authority.client;
|
||||
let began = false;
|
||||
try {
|
||||
client.exec('BEGIN IMMEDIATE');
|
||||
began = true;
|
||||
const replay = findRecord(
|
||||
client,
|
||||
command.mutationId,
|
||||
command.transformationDigest,
|
||||
);
|
||||
if (replay) {
|
||||
if (!exactReplay(replay, command)) {
|
||||
throw new LocalDataDirectoryAdoptionConflictError();
|
||||
}
|
||||
await command.confirmExternalAuthority();
|
||||
client.exec('COMMIT');
|
||||
began = false;
|
||||
return Object.freeze({
|
||||
status: 'existing' as const,
|
||||
adoption: replay,
|
||||
});
|
||||
}
|
||||
|
||||
const project = client
|
||||
.prepare(
|
||||
`SELECT "version", "status" FROM "QingLong3Projects"
|
||||
WHERE "id" = ? LIMIT 1`,
|
||||
)
|
||||
.get(command.projectId) as Row | undefined;
|
||||
if (
|
||||
!project ||
|
||||
integer(project, 'version') !== command.fence.projectVersion ||
|
||||
text(project, 'status') !== 'active'
|
||||
) {
|
||||
throw new LocalDataDirectoryAdoptionAuthorizationFenceConflictError();
|
||||
}
|
||||
const binding = client
|
||||
.prepare(
|
||||
`SELECT "version", "state", "role"
|
||||
FROM "QingLong3ProjectRoleBindings"
|
||||
WHERE "project_id" = ? AND "subject_type" = ? AND "subject_id" = ?
|
||||
ORDER BY "version" DESC LIMIT 1`,
|
||||
)
|
||||
.get(
|
||||
command.projectId,
|
||||
normalized.subject.type,
|
||||
normalized.subject.id,
|
||||
) as Row | undefined;
|
||||
if (
|
||||
!binding ||
|
||||
integer(binding, 'version') !== command.fence.bindingVersion ||
|
||||
text(binding, 'state') !== 'active' ||
|
||||
!['owner', 'admin'].includes(text(binding, 'role'))
|
||||
) {
|
||||
throw new LocalDataDirectoryAdoptionAuthorizationFenceConflictError();
|
||||
}
|
||||
|
||||
for (const { envelope, audit } of normalized.secrets) {
|
||||
const current = client
|
||||
.prepare(
|
||||
`SELECT MAX("version") AS "version"
|
||||
FROM "QingLong3LocalSecretEnvelopes"
|
||||
WHERE "project_id" = ? AND "secret_name" = ?`,
|
||||
)
|
||||
.get(envelope.projectId, envelope.name) as Row;
|
||||
if (current.version !== null) {
|
||||
throw new LocalDataDirectoryAdoptionConflictError();
|
||||
}
|
||||
const nonce = Buffer.from(envelope.nonce, 'base64url');
|
||||
const ciphertext = Buffer.from(envelope.ciphertext, 'base64url');
|
||||
const authTag = Buffer.from(envelope.authTag, 'base64url');
|
||||
try {
|
||||
client
|
||||
.prepare(
|
||||
`INSERT INTO "QingLong3LocalSecretEnvelopes" (
|
||||
"project_id", "secret_name", "version", "mutation_id",
|
||||
"key_id", "algorithm", "nonce", "ciphertext", "auth_tag",
|
||||
"created_at_ms"
|
||||
) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
|
||||
)
|
||||
.run(
|
||||
envelope.projectId,
|
||||
envelope.name,
|
||||
envelope.version,
|
||||
envelope.mutationId,
|
||||
envelope.keyId,
|
||||
envelope.algorithm,
|
||||
nonce,
|
||||
ciphertext,
|
||||
authTag,
|
||||
envelope.createdAtMs,
|
||||
);
|
||||
} finally {
|
||||
nonce.fill(0);
|
||||
ciphertext.fill(0);
|
||||
authTag.fill(0);
|
||||
}
|
||||
insertAudit(client, audit);
|
||||
}
|
||||
insertAudit(client, normalized.audit);
|
||||
client
|
||||
.prepare(
|
||||
`INSERT INTO "QingLong3LegacyDataDirectoryAdoptions" (
|
||||
"mutation_id", "project_id", "profile",
|
||||
"source_stage_manifest_digest", "transformation_digest",
|
||||
"model_digest", "secret_count", "environment_secret_count",
|
||||
"ssh_secret_count", "model_json", "publication_digest",
|
||||
"audit_event_id", "committed_at_ms", "receipt_digest",
|
||||
"receipt_json"
|
||||
) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
|
||||
)
|
||||
.run(
|
||||
command.mutationId,
|
||||
command.projectId,
|
||||
command.profile,
|
||||
command.sourceStageManifestDigest,
|
||||
command.transformationDigest,
|
||||
command.modelDigest,
|
||||
command.receipt.secretCount,
|
||||
command.receipt.environmentSecretCount,
|
||||
command.receipt.sshSecretCount,
|
||||
JSON.stringify(command.model),
|
||||
command.receipt.publicationDigest,
|
||||
command.mutationId,
|
||||
command.receipt.committedAtMs,
|
||||
command.receipt.receiptDigest,
|
||||
JSON.stringify(command.receipt),
|
||||
);
|
||||
for (const { record } of normalized.secrets) {
|
||||
client
|
||||
.prepare(
|
||||
`INSERT INTO "QingLong3LegacyDataDirectoryAdoptionSecrets" (
|
||||
"adoption_mutation_id", "ordinal", "project_id", "kind",
|
||||
"source_name_digest", "secret_name", "secret_version",
|
||||
"secret_mutation_id", "value_file", "value_digest",
|
||||
"secret_ref", "item_digest"
|
||||
) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
|
||||
)
|
||||
.run(
|
||||
command.mutationId,
|
||||
record.ordinal,
|
||||
command.projectId,
|
||||
record.kind,
|
||||
record.sourceNameDigest,
|
||||
record.secretName,
|
||||
record.secretVersion,
|
||||
record.secretMutationId,
|
||||
record.valueFile,
|
||||
record.valueDigest,
|
||||
record.secretRef,
|
||||
record.itemDigest,
|
||||
);
|
||||
}
|
||||
const stored = findRecord(client, command.mutationId);
|
||||
if (!stored || !exactReplay(stored, command)) {
|
||||
throw new LocalDataDirectoryAdoptionUnavailableError();
|
||||
}
|
||||
await command.confirmExternalAuthority();
|
||||
client.exec('COMMIT');
|
||||
began = false;
|
||||
return Object.freeze({
|
||||
status: 'inserted' as const,
|
||||
adoption: stored,
|
||||
});
|
||||
} catch (error) {
|
||||
if (began && client.isTransaction) {
|
||||
try {
|
||||
client.exec('ROLLBACK');
|
||||
} catch {
|
||||
// Preserve the original failure.
|
||||
}
|
||||
}
|
||||
if (
|
||||
error instanceof LocalDataDirectoryAdoptionConflictError ||
|
||||
error instanceof
|
||||
LocalDataDirectoryAdoptionAuthorizationFenceConflictError ||
|
||||
error instanceof LocalDataDirectoryAdoptionUnavailableError
|
||||
) {
|
||||
throw error;
|
||||
}
|
||||
if (
|
||||
error &&
|
||||
typeof error === 'object' &&
|
||||
'code' in error &&
|
||||
typeof error.code === 'string' &&
|
||||
error.code.startsWith('SQLITE_CONSTRAINT')
|
||||
) {
|
||||
throw new LocalDataDirectoryAdoptionConflictError();
|
||||
}
|
||||
throw new LocalDataDirectoryAdoptionUnavailableError(error);
|
||||
}
|
||||
},
|
||||
() => new LocalDataDirectoryAdoptionUnavailableError(),
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
export interface LocalSqliteDataDirectoryAdoptionDatabase {
|
||||
readonly profile: LocalSqliteProfile;
|
||||
readonly readiness: LocalSqliteReadinessEvidence;
|
||||
readonly projectPolicy: ProjectPolicyRepository;
|
||||
readonly securityAudit: SecurityAuditSink;
|
||||
readonly publisher: LocalSqliteDataDirectoryAdoptionPublisher;
|
||||
close(): Promise<void>;
|
||||
}
|
||||
|
||||
/** Short-lived data-directory adoption authority; runtime hosts must not import it. */
|
||||
export async function openLocalSqliteDataDirectoryAdoptionDatabase(
|
||||
options: LocalSqliteDatabaseOptions,
|
||||
): Promise<LocalSqliteDataDirectoryAdoptionDatabase> {
|
||||
assertLocalSqliteOptions(options);
|
||||
assertLocalSqlitePathBoundary(options.databasePath, false);
|
||||
const client = openLocalSqliteClient(options, false);
|
||||
try {
|
||||
const readiness = await auditLocalSqliteReadiness(client);
|
||||
const authority = new LocalSqliteOperationAuthority(client);
|
||||
const securityAuthority = new LocalSqliteSecurityAuthorityStore(authority);
|
||||
const projectPolicy: ProjectPolicyRepository = Object.freeze({
|
||||
resolve: (
|
||||
...[projectId, subject]: Parameters<ProjectPolicyRepository['resolve']>
|
||||
) => securityAuthority.resolve(projectId, subject),
|
||||
append: (...[command]: Parameters<ProjectPolicyRepository['append']>) =>
|
||||
securityAuthority.append(command),
|
||||
});
|
||||
let closePromise: Promise<void> | undefined;
|
||||
return Object.freeze({
|
||||
profile: options.profile,
|
||||
readiness,
|
||||
projectPolicy,
|
||||
securityAudit: securityAuthority,
|
||||
publisher: new LocalSqliteDataDirectoryAdoptionPublisher(authority),
|
||||
close() {
|
||||
if (closePromise) return closePromise;
|
||||
closePromise = authority.close();
|
||||
return closePromise;
|
||||
},
|
||||
});
|
||||
} catch (error) {
|
||||
if (client.isOpen) client.close();
|
||||
throw error;
|
||||
}
|
||||
}
|
||||
+17
@@ -0,0 +1,17 @@
|
||||
export const LOCAL_DATA_DIRECTORY_ADOPTION_SECRET_GUARD_TRIGGER_SQL = `
|
||||
CREATE TRIGGER "ql3_legacy_data_directory_adoption_secret_guard"
|
||||
BEFORE INSERT ON "QingLong3LegacyDataDirectoryAdoptionSecrets"
|
||||
BEGIN
|
||||
SELECT CASE WHEN NOT EXISTS (
|
||||
SELECT 1
|
||||
FROM "QingLong3LegacyDataDirectoryAdoptions" AS adoption
|
||||
JOIN "QingLong3LocalSecretEnvelopes" AS secret
|
||||
ON secret."project_id" = NEW."project_id"
|
||||
AND secret."secret_name" = NEW."secret_name"
|
||||
AND secret."version" = NEW."secret_version"
|
||||
WHERE adoption."mutation_id" = NEW."adoption_mutation_id"
|
||||
AND adoption."project_id" = NEW."project_id"
|
||||
AND secret."mutation_id" = NEW."secret_mutation_id"
|
||||
) THEN RAISE(ABORT, 'legacy data directory adoption Secret authority mismatch') END;
|
||||
END
|
||||
`.trim();
|
||||
@@ -108,6 +108,8 @@ import { local0095PluginPackageSecretBindingTargetGuardMigration } from '../migr
|
||||
import { local0096CapabilityV48Migration } from '../migrations/0096-capability-v48';
|
||||
import { local0097PluginPackageSecretBindingTransitionReceiptsMigration } from '../migrations/0097-plugin-package-secret-binding-transition-receipts';
|
||||
import { local0098CapabilityV49Migration } from '../migrations/0098-capability-v49';
|
||||
import { local0099LegacyDataDirectoryAdoptionsMigration } from '../migrations/0099-legacy-data-directory-adoptions';
|
||||
import { local0100CapabilityV50Migration } from '../migrations/0100-capability-v50';
|
||||
import type { LocalSqliteMigrationContext } from '../migrations/sqlMigration';
|
||||
import {
|
||||
LOCAL_SQLITE_MIGRATION_STREAM_ID,
|
||||
@@ -228,6 +230,8 @@ export const localSqliteMigrationDefinition: MigrationStreamDefinition<LocalSqli
|
||||
local0096CapabilityV48Migration,
|
||||
local0097PluginPackageSecretBindingTransitionReceiptsMigration,
|
||||
local0098CapabilityV49Migration,
|
||||
local0099LegacyDataDirectoryAdoptionsMigration,
|
||||
local0100CapabilityV50Migration,
|
||||
]),
|
||||
});
|
||||
|
||||
|
||||
@@ -502,5 +502,15 @@ export const localSqliteMigrationManifest: MigrationStreamManifest =
|
||||
checksum:
|
||||
'133bdb78900256971bb6e13de8a129024d09f9d4c9d9290137eca3ff6e8b30eb',
|
||||
}),
|
||||
Object.freeze({
|
||||
id: '0099-legacy-data-directory-adoptions',
|
||||
checksum:
|
||||
'5a9edabd6a3e13cd8d71be6e85e3f211269b1909295aea27573c567c15112fd2',
|
||||
}),
|
||||
Object.freeze({
|
||||
id: '0100-capability-v50',
|
||||
checksum:
|
||||
'ea4ef39fe237d8db032da89c8f79dfda631b7201d1e5ac8c743b67e75aad5b07',
|
||||
}),
|
||||
]),
|
||||
});
|
||||
|
||||
@@ -0,0 +1,179 @@
|
||||
import { defineLocalSqliteMigration } from './sqlMigration';
|
||||
import { LOCAL_DATA_DIRECTORY_ADOPTION_SECRET_GUARD_TRIGGER_SQL } from '../adoption/data-directory/dataDirectoryAdoptionSchemaContract';
|
||||
|
||||
export const local0099LegacyDataDirectoryAdoptionsMigration =
|
||||
defineLocalSqliteMigration({
|
||||
id: '0099-legacy-data-directory-adoptions',
|
||||
statements: [
|
||||
`
|
||||
CREATE TABLE "QingLong3LegacyDataDirectoryAdoptions" (
|
||||
"mutation_id" TEXT PRIMARY KEY NOT NULL,
|
||||
"project_id" TEXT NOT NULL,
|
||||
"profile" TEXT NOT NULL,
|
||||
"source_stage_manifest_digest" TEXT NOT NULL,
|
||||
"transformation_digest" TEXT NOT NULL,
|
||||
"model_digest" TEXT NOT NULL,
|
||||
"secret_count" INTEGER NOT NULL,
|
||||
"environment_secret_count" INTEGER NOT NULL,
|
||||
"ssh_secret_count" INTEGER NOT NULL,
|
||||
"model_json" TEXT NOT NULL,
|
||||
"publication_digest" TEXT NOT NULL,
|
||||
"audit_event_id" TEXT NOT NULL,
|
||||
"committed_at_ms" INTEGER NOT NULL,
|
||||
"receipt_digest" TEXT NOT NULL,
|
||||
"receipt_json" TEXT NOT NULL,
|
||||
CONSTRAINT ql3_legacy_data_directory_adoption_project_fk
|
||||
FOREIGN KEY ("project_id")
|
||||
REFERENCES "QingLong3Projects" ("id")
|
||||
ON DELETE RESTRICT ON UPDATE RESTRICT,
|
||||
CONSTRAINT ql3_legacy_data_directory_adoption_audit_fk
|
||||
FOREIGN KEY ("audit_event_id")
|
||||
REFERENCES "QingLong3SecurityAuditEvents" ("event_id")
|
||||
ON DELETE RESTRICT ON UPDATE RESTRICT,
|
||||
CONSTRAINT ql3_legacy_data_directory_adoption_identity_check CHECK (
|
||||
length("mutation_id") = 36 AND
|
||||
substr("mutation_id", 15, 1) = '4' AND
|
||||
replace("mutation_id", '-', '') NOT GLOB '*[^0-9a-f]*' AND
|
||||
"audit_event_id" = "mutation_id" AND
|
||||
length("project_id") BETWEEN 1 AND 128
|
||||
),
|
||||
CONSTRAINT ql3_legacy_data_directory_adoption_profile_check CHECK (
|
||||
"profile" IN ('edge', 'standalone')
|
||||
),
|
||||
CONSTRAINT ql3_legacy_data_directory_adoption_digest_check CHECK (
|
||||
length("source_stage_manifest_digest") = 64 AND
|
||||
"source_stage_manifest_digest" NOT GLOB '*[^0-9a-f]*' AND
|
||||
length("transformation_digest") = 64 AND
|
||||
"transformation_digest" NOT GLOB '*[^0-9a-f]*' AND
|
||||
length("model_digest") = 64 AND
|
||||
"model_digest" NOT GLOB '*[^0-9a-f]*' AND
|
||||
length("publication_digest") = 64 AND
|
||||
"publication_digest" NOT GLOB '*[^0-9a-f]*' AND
|
||||
length("receipt_digest") = 64 AND
|
||||
"receipt_digest" NOT GLOB '*[^0-9a-f]*'
|
||||
),
|
||||
CONSTRAINT ql3_legacy_data_directory_adoption_count_check CHECK (
|
||||
"secret_count" BETWEEN 0 AND CASE "profile" WHEN 'edge' THEN 128 ELSE 512 END AND
|
||||
"environment_secret_count" BETWEEN 0 AND "secret_count" AND
|
||||
"ssh_secret_count" BETWEEN 0 AND "secret_count" AND
|
||||
"environment_secret_count" + "ssh_secret_count" = "secret_count"
|
||||
),
|
||||
CONSTRAINT ql3_legacy_data_directory_adoption_model_check CHECK (
|
||||
length(CAST("model_json" AS BLOB)) BETWEEN 2 AND 1048576 AND
|
||||
json_valid("model_json") AND json_type("model_json") = 'object' AND
|
||||
json_extract("model_json", '$.schema') = 'qinglong/legacy-data-directory-applied-model@v1' AND
|
||||
json_extract("model_json", '$.activation') = 'disabled' AND
|
||||
json_extract("model_json", '$.config.schema') = 'qinglong/legacy-config-transformation@v1' AND
|
||||
json_extract("model_json", '$.config.activation') = 'disabled' AND
|
||||
json_extract("model_json", '$.keyv.schema') = 'qinglong/legacy-keyv-transformation@v1' AND
|
||||
json_extract("model_json", '$.keyv.activation') = 'disabled' AND
|
||||
json_extract("model_json", '$.ssh.schema') = 'qinglong/legacy-ssh-transformation@v1' AND
|
||||
json_extract("model_json", '$.ssh.activation') = 'disabled' AND
|
||||
json_extract("model_json", '$.manualReview.schema') = 'qinglong/legacy-data-directory-manual-review@v1' AND
|
||||
json_extract("model_json", '$.manualReview.required') = 0 AND
|
||||
json_extract("model_json", '$.manualReview.activation') = 'disabled'
|
||||
),
|
||||
CONSTRAINT ql3_legacy_data_directory_adoption_receipt_check CHECK (
|
||||
length(CAST("receipt_json" AS BLOB)) BETWEEN 2 AND 1048576 AND
|
||||
json_valid("receipt_json") AND json_type("receipt_json") = 'object' AND
|
||||
json_extract("receipt_json", '$.schema') = 'qinglong/legacy-data-directory-adoption-receipt@v1' AND
|
||||
json_extract("receipt_json", '$.mutationId') = "mutation_id" AND
|
||||
json_extract("receipt_json", '$.projectId') = "project_id" AND
|
||||
json_extract("receipt_json", '$.profile') = "profile" AND
|
||||
json_extract("receipt_json", '$.sourceStageManifestDigest') = "source_stage_manifest_digest" AND
|
||||
json_extract("receipt_json", '$.transformationDigest') = "transformation_digest" AND
|
||||
json_extract("receipt_json", '$.modelDigest') = "model_digest" AND
|
||||
json_extract("receipt_json", '$.secretCount') = "secret_count" AND
|
||||
json_extract("receipt_json", '$.environmentSecretCount') = "environment_secret_count" AND
|
||||
json_extract("receipt_json", '$.sshSecretCount') = "ssh_secret_count" AND
|
||||
json_extract("receipt_json", '$.publicationDigest') = "publication_digest" AND
|
||||
json_extract("receipt_json", '$.auditEventId') = "audit_event_id" AND
|
||||
json_extract("receipt_json", '$.committedAtMs') = "committed_at_ms" AND
|
||||
json_extract("receipt_json", '$.receiptDigest') = "receipt_digest"
|
||||
),
|
||||
CONSTRAINT ql3_legacy_data_directory_adoption_time_check CHECK (
|
||||
"committed_at_ms" >= 0
|
||||
)
|
||||
)
|
||||
`,
|
||||
`
|
||||
CREATE UNIQUE INDEX "ql3_legacy_data_directory_adoption_transformation_uidx"
|
||||
ON "QingLong3LegacyDataDirectoryAdoptions" ("transformation_digest")
|
||||
`,
|
||||
`
|
||||
CREATE UNIQUE INDEX "ql3_legacy_data_directory_adoption_receipt_uidx"
|
||||
ON "QingLong3LegacyDataDirectoryAdoptions" ("receipt_digest")
|
||||
`,
|
||||
`
|
||||
CREATE INDEX "ql3_legacy_data_directory_adoption_project_time_idx"
|
||||
ON "QingLong3LegacyDataDirectoryAdoptions" (
|
||||
"project_id", "committed_at_ms" DESC, "mutation_id" DESC
|
||||
)
|
||||
`,
|
||||
`
|
||||
CREATE TABLE "QingLong3LegacyDataDirectoryAdoptionSecrets" (
|
||||
"adoption_mutation_id" TEXT NOT NULL,
|
||||
"ordinal" INTEGER NOT NULL,
|
||||
"project_id" TEXT NOT NULL,
|
||||
"kind" TEXT NOT NULL,
|
||||
"source_name_digest" TEXT NOT NULL,
|
||||
"secret_name" TEXT NOT NULL,
|
||||
"secret_version" INTEGER NOT NULL,
|
||||
"secret_mutation_id" TEXT NOT NULL,
|
||||
"value_file" TEXT NOT NULL,
|
||||
"value_digest" TEXT NOT NULL,
|
||||
"secret_ref" TEXT NOT NULL,
|
||||
"item_digest" TEXT NOT NULL,
|
||||
PRIMARY KEY ("adoption_mutation_id", "ordinal"),
|
||||
CONSTRAINT ql3_legacy_data_directory_adoption_secret_parent_fk
|
||||
FOREIGN KEY ("adoption_mutation_id")
|
||||
REFERENCES "QingLong3LegacyDataDirectoryAdoptions" ("mutation_id")
|
||||
ON DELETE RESTRICT ON UPDATE RESTRICT,
|
||||
CONSTRAINT ql3_legacy_data_directory_adoption_secret_envelope_fk
|
||||
FOREIGN KEY ("project_id", "secret_name", "secret_version")
|
||||
REFERENCES "QingLong3LocalSecretEnvelopes" ("project_id", "secret_name", "version")
|
||||
ON DELETE RESTRICT ON UPDATE RESTRICT,
|
||||
CONSTRAINT ql3_legacy_data_directory_adoption_secret_audit_fk
|
||||
FOREIGN KEY ("secret_mutation_id")
|
||||
REFERENCES "QingLong3SecurityAuditEvents" ("event_id")
|
||||
ON DELETE RESTRICT ON UPDATE RESTRICT,
|
||||
CONSTRAINT ql3_legacy_data_directory_adoption_secret_identity_check CHECK (
|
||||
"ordinal" BETWEEN 1 AND 512 AND
|
||||
length("project_id") BETWEEN 1 AND 128 AND
|
||||
"kind" IN ('environment', 'ssh_private_key') AND
|
||||
length("secret_name") BETWEEN 1 AND 128 AND
|
||||
"secret_version" = 1 AND
|
||||
length("secret_mutation_id") = 36 AND
|
||||
substr("secret_mutation_id", 15, 1) = '4' AND
|
||||
replace("secret_mutation_id", '-', '') NOT GLOB '*[^0-9a-f]*' AND
|
||||
length("value_file") = 83 AND
|
||||
"value_file" GLOB 'secret-values/[0-9a-f]*.json' AND
|
||||
length("secret_ref") BETWEEN 1 AND 512
|
||||
),
|
||||
CONSTRAINT ql3_legacy_data_directory_adoption_secret_digest_check CHECK (
|
||||
length("source_name_digest") = 64 AND
|
||||
"source_name_digest" NOT GLOB '*[^0-9a-f]*' AND
|
||||
length("value_digest") = 64 AND
|
||||
"value_digest" NOT GLOB '*[^0-9a-f]*' AND
|
||||
length("item_digest") = 64 AND
|
||||
"item_digest" NOT GLOB '*[^0-9a-f]*'
|
||||
)
|
||||
)
|
||||
`,
|
||||
`
|
||||
CREATE UNIQUE INDEX "ql3_legacy_data_directory_adoption_secret_name_uidx"
|
||||
ON "QingLong3LegacyDataDirectoryAdoptionSecrets" (
|
||||
"adoption_mutation_id", "secret_name"
|
||||
)
|
||||
`,
|
||||
`
|
||||
CREATE UNIQUE INDEX "ql3_legacy_data_directory_adoption_secret_mutation_uidx"
|
||||
ON "QingLong3LegacyDataDirectoryAdoptionSecrets" ("secret_mutation_id")
|
||||
`,
|
||||
`
|
||||
CREATE UNIQUE INDEX "ql3_legacy_data_directory_adoption_secret_item_uidx"
|
||||
ON "QingLong3LegacyDataDirectoryAdoptionSecrets" ("item_digest")
|
||||
`,
|
||||
LOCAL_DATA_DIRECTORY_ADOPTION_SECRET_GUARD_TRIGGER_SQL,
|
||||
],
|
||||
});
|
||||
@@ -0,0 +1,14 @@
|
||||
import { CAPABILITIES_V49 } from './0098-capability-v49';
|
||||
import { defineLocalSqliteMigration } from './sqlMigration';
|
||||
|
||||
export const CAPABILITIES_V50 = CAPABILITIES_V49.replace(
|
||||
'"legacy_adoption_ledger":1,',
|
||||
'"legacy_adoption_ledger":1,"legacy_data_directory_adoption":1,',
|
||||
);
|
||||
|
||||
export const local0100CapabilityV50Migration = defineLocalSqliteMigration({
|
||||
id: '0100-capability-v50',
|
||||
statements: [
|
||||
`UPDATE "QingLong3SchemaCapabilities" SET contract_version = 50, migration_id = '0099-legacy-data-directory-adoptions', capabilities = '${CAPABILITIES_V50}', updated_at_ms = CAST(unixepoch('subsec') * 1000 AS INTEGER) WHERE contract_name = 'local-control-core' AND contract_version = 49 AND migration_id = '0097-plugin-package-secret-binding-transition-receipts' AND capabilities = '${CAPABILITIES_V49}'`,
|
||||
],
|
||||
});
|
||||
@@ -2,6 +2,7 @@ import { auditMigrationStreamHistory } from '@qinglong/runtime-core/migration-st
|
||||
import type { DatabaseSync } from 'node:sqlite';
|
||||
import { localSqliteMigrationManifest } from '../migration/migrationManifest';
|
||||
import { LocalSqliteMigrationStreamStore } from '../migration/migrationStreamStore';
|
||||
import { LOCAL_DATA_DIRECTORY_ADOPTION_SECRET_GUARD_TRIGGER_SQL } from '../adoption/data-directory/dataDirectoryAdoptionSchemaContract';
|
||||
import { LOCAL_PLUGIN_PACKAGE_SECRET_MATERIALIZATION_TRIGGER_SQL } from '../plugin-package/pluginPackageSecretMaterializationSchemaContract';
|
||||
import { LOCAL_PLUGIN_PACKAGE_SECRET_BINDING_TARGET_TRIGGER_SQL } from '../plugin-package/secret-binding/pluginPackageSecretBindingTargetSchemaContract';
|
||||
import { LOCAL_PLUGIN_PACKAGE_SECRET_BINDING_TRANSITION_RECEIPT_TRIGGER_SQL } from '../plugin-package/secret-binding/transitionReceiptSchemaContract';
|
||||
@@ -11,7 +12,15 @@ import {
|
||||
} from '../run/stepRunSchemaContract';
|
||||
|
||||
export const LOCAL_SQLITE_CONTRACT_NAME = 'local-control-core';
|
||||
export const LOCAL_SQLITE_CONTRACT_VERSION = 49;
|
||||
export const LOCAL_SQLITE_CONTRACT_VERSION = 50;
|
||||
|
||||
const LEGACY_DATA_DIRECTORY_ADOPTION_TRIGGERS = Object.freeze([
|
||||
Object.freeze({
|
||||
name: 'ql3_legacy_data_directory_adoption_secret_guard',
|
||||
tableName: 'QingLong3LegacyDataDirectoryAdoptionSecrets',
|
||||
sql: LOCAL_DATA_DIRECTORY_ADOPTION_SECRET_GUARD_TRIGGER_SQL,
|
||||
}),
|
||||
]);
|
||||
|
||||
const PLUGIN_PACKAGE_SECRET_BINDING_TARGET_TRIGGERS = Object.freeze([
|
||||
Object.freeze({
|
||||
@@ -1389,6 +1398,51 @@ const REQUIRED_SCHEMA = Object.freeze({
|
||||
'ql3_legacy_adoptions_project_time_idx',
|
||||
]),
|
||||
}),
|
||||
QingLong3LegacyDataDirectoryAdoptions: Object.freeze({
|
||||
columns: Object.freeze([
|
||||
'mutation_id',
|
||||
'project_id',
|
||||
'profile',
|
||||
'source_stage_manifest_digest',
|
||||
'transformation_digest',
|
||||
'model_digest',
|
||||
'secret_count',
|
||||
'environment_secret_count',
|
||||
'ssh_secret_count',
|
||||
'model_json',
|
||||
'publication_digest',
|
||||
'audit_event_id',
|
||||
'committed_at_ms',
|
||||
'receipt_digest',
|
||||
'receipt_json',
|
||||
]),
|
||||
indexes: Object.freeze([
|
||||
'ql3_legacy_data_directory_adoption_transformation_uidx',
|
||||
'ql3_legacy_data_directory_adoption_receipt_uidx',
|
||||
'ql3_legacy_data_directory_adoption_project_time_idx',
|
||||
]),
|
||||
}),
|
||||
QingLong3LegacyDataDirectoryAdoptionSecrets: Object.freeze({
|
||||
columns: Object.freeze([
|
||||
'adoption_mutation_id',
|
||||
'ordinal',
|
||||
'project_id',
|
||||
'kind',
|
||||
'source_name_digest',
|
||||
'secret_name',
|
||||
'secret_version',
|
||||
'secret_mutation_id',
|
||||
'value_file',
|
||||
'value_digest',
|
||||
'secret_ref',
|
||||
'item_digest',
|
||||
]),
|
||||
indexes: Object.freeze([
|
||||
'ql3_legacy_data_directory_adoption_secret_name_uidx',
|
||||
'ql3_legacy_data_directory_adoption_secret_mutation_uidx',
|
||||
'ql3_legacy_data_directory_adoption_secret_item_uidx',
|
||||
]),
|
||||
}),
|
||||
QingLong3IdentitySubjects: Object.freeze({
|
||||
columns: Object.freeze([
|
||||
'subject_type',
|
||||
@@ -1793,6 +1847,7 @@ function assertRequiredSchema(client: DatabaseSync): number {
|
||||
...PLUGIN_PACKAGE_AUTOMATION_DISPOSITION_TRIGGERS,
|
||||
...PLUGIN_PACKAGE_SECRET_BINDING_TARGET_TRIGGERS,
|
||||
...PLUGIN_PACKAGE_SECRET_MATERIALIZATION_TRIGGERS,
|
||||
...LEGACY_DATA_DIRECTORY_ADOPTION_TRIGGERS,
|
||||
].sort((left, right) => left.name.localeCompare(right.name));
|
||||
if (
|
||||
triggerRows.length !== expectedTriggers.length ||
|
||||
@@ -2603,11 +2658,10 @@ export async function auditLocalSqliteReadiness(
|
||||
!capability ||
|
||||
capability.contract_name !== LOCAL_SQLITE_CONTRACT_NAME ||
|
||||
capability.contract_version !== LOCAL_SQLITE_CONTRACT_VERSION ||
|
||||
capability.migration_id !==
|
||||
'0097-plugin-package-secret-binding-transition-receipts' ||
|
||||
capability.migration_id !== '0099-legacy-data-directory-adoptions' ||
|
||||
typeof capability.capabilities !== 'string' ||
|
||||
capability.capabilities !==
|
||||
'{"run_core":1,"run_retry_policy":1,"completion_receipt_journal":1,"local_dispatch_plan":1,"local_secret_envelope":1,"local_project_policy":1,"local_project_administration":1,"local_security_audit":1,"local_security_audit_compaction":1,"local_secret_authorized_mutation":1,"local_identity":1,"local_api_credential":1,"local_identity_provisioning":1,"local_identity_credential_administration":1,"local_owner_bootstrap":1,"local_owner_delivery_acknowledgement":1,"api_credential_pepper_binding":1,"local_owner_pepper_catalog":1,"local_owner_credential_recovery":1,"local_owner_pepper_reference_inspection":1,"local_owner_pepper_material_gc":1,"local_owner_delivery_acknowledgement_gc":1,"task_definition":1,"local_execution_revision_digest":1,"trigger_definition":1,"legacy_adoption_ledger":1,"local_scheduler_admission":1,"plugin_package_install":1,"approved_action":1,"plugin_package_admission":1,"approved_action_execution":1,"plugin_package_proposal":1,"plugin_package_materialized_revision":1,"plugin_package_secret_binding":1,"plugin_package_secret_binding_transition":1,"plugin_package_secret_binding_transition_receipt":1,"plugin_package_secret_materialization":1,"plugin_package_task_reconciliation":1,"project_tool_definition_snapshot":1,"step_run":1,"tool_execution_evidence":1,"tool_execution_start_barrier":1,"tool_invocation_artifact":1,"tool_execution_artifact_binding":1,"tool_execution_completion":1,"tool_execution_failure_completion":1,"tool_result_key_catalog":1,"tool_result_rekey":1,"plugin_package_quarantine":1,"plugin_package_lifecycle":1,"plugin_package_automation_publication":1,"plugin_package_automation_security_withdrawal":1,"plugin_package_workflow_admission":1,"plugin_package_workflow_run_list":1,"run_attempt_log_retention":1,"plugin_package_workflow_task_attempt_admission":1}' ||
|
||||
'{"run_core":1,"run_retry_policy":1,"completion_receipt_journal":1,"local_dispatch_plan":1,"local_secret_envelope":1,"local_project_policy":1,"local_project_administration":1,"local_security_audit":1,"local_security_audit_compaction":1,"local_secret_authorized_mutation":1,"local_identity":1,"local_api_credential":1,"local_identity_provisioning":1,"local_identity_credential_administration":1,"local_owner_bootstrap":1,"local_owner_delivery_acknowledgement":1,"api_credential_pepper_binding":1,"local_owner_pepper_catalog":1,"local_owner_credential_recovery":1,"local_owner_pepper_reference_inspection":1,"local_owner_pepper_material_gc":1,"local_owner_delivery_acknowledgement_gc":1,"task_definition":1,"local_execution_revision_digest":1,"trigger_definition":1,"legacy_adoption_ledger":1,"legacy_data_directory_adoption":1,"local_scheduler_admission":1,"plugin_package_install":1,"approved_action":1,"plugin_package_admission":1,"approved_action_execution":1,"plugin_package_proposal":1,"plugin_package_materialized_revision":1,"plugin_package_secret_binding":1,"plugin_package_secret_binding_transition":1,"plugin_package_secret_binding_transition_receipt":1,"plugin_package_secret_materialization":1,"plugin_package_task_reconciliation":1,"project_tool_definition_snapshot":1,"step_run":1,"tool_execution_evidence":1,"tool_execution_start_barrier":1,"tool_invocation_artifact":1,"tool_execution_artifact_binding":1,"tool_execution_completion":1,"tool_execution_failure_completion":1,"tool_result_key_catalog":1,"tool_result_rekey":1,"plugin_package_quarantine":1,"plugin_package_lifecycle":1,"plugin_package_automation_publication":1,"plugin_package_automation_security_withdrawal":1,"plugin_package_workflow_admission":1,"plugin_package_workflow_run_list":1,"run_attempt_log_retention":1,"plugin_package_workflow_task_attempt_admission":1}' ||
|
||||
typeof capability.updated_at_ms !== 'number' ||
|
||||
!Number.isSafeInteger(capability.updated_at_ms) ||
|
||||
capability.updated_at_ms < 0
|
||||
|
||||
@@ -3328,6 +3328,144 @@ export const legacyAdoptions = sqliteTable(
|
||||
],
|
||||
);
|
||||
|
||||
export const legacyDataDirectoryAdoptions = sqliteTable(
|
||||
'QingLong3LegacyDataDirectoryAdoptions',
|
||||
{
|
||||
mutationId: text('mutation_id').primaryKey(),
|
||||
projectId: text('project_id')
|
||||
.notNull()
|
||||
.references(() => localProjects.id, {
|
||||
onDelete: 'restrict',
|
||||
onUpdate: 'restrict',
|
||||
}),
|
||||
profile: text('profile').notNull(),
|
||||
sourceStageManifestDigest: text('source_stage_manifest_digest').notNull(),
|
||||
transformationDigest: text('transformation_digest').notNull(),
|
||||
modelDigest: text('model_digest').notNull(),
|
||||
secretCount: integer('secret_count').notNull(),
|
||||
environmentSecretCount: integer('environment_secret_count').notNull(),
|
||||
sshSecretCount: integer('ssh_secret_count').notNull(),
|
||||
modelJson: text('model_json', { mode: 'json' })
|
||||
.$type<Record<string, unknown>>()
|
||||
.notNull(),
|
||||
publicationDigest: text('publication_digest').notNull(),
|
||||
auditEventId: text('audit_event_id')
|
||||
.notNull()
|
||||
.references(() => localSecurityAuditEvents.eventId, {
|
||||
onDelete: 'restrict',
|
||||
onUpdate: 'restrict',
|
||||
}),
|
||||
committedAtMs: integer('committed_at_ms').notNull(),
|
||||
receiptDigest: text('receipt_digest').notNull(),
|
||||
receiptJson: text('receipt_json', { mode: 'json' })
|
||||
.$type<Record<string, unknown>>()
|
||||
.notNull(),
|
||||
},
|
||||
(table) => [
|
||||
check(
|
||||
'ql3_legacy_data_directory_adoption_identity_check',
|
||||
sql`length(${table.mutationId}) = 36 and substr(${table.mutationId}, 15, 1) = '4' and replace(${table.mutationId}, '-', '') not glob '*[^0-9a-f]*' and ${table.auditEventId} = ${table.mutationId} and length(${table.projectId}) between 1 and 128`,
|
||||
),
|
||||
check(
|
||||
'ql3_legacy_data_directory_adoption_profile_check',
|
||||
sql`${table.profile} in ('edge', 'standalone')`,
|
||||
),
|
||||
check(
|
||||
'ql3_legacy_data_directory_adoption_digest_check',
|
||||
sql`length(${table.sourceStageManifestDigest}) = 64 and ${table.sourceStageManifestDigest} not glob '*[^0-9a-f]*' and length(${table.transformationDigest}) = 64 and ${table.transformationDigest} not glob '*[^0-9a-f]*' and length(${table.modelDigest}) = 64 and ${table.modelDigest} not glob '*[^0-9a-f]*' and length(${table.publicationDigest}) = 64 and ${table.publicationDigest} not glob '*[^0-9a-f]*' and length(${table.receiptDigest}) = 64 and ${table.receiptDigest} not glob '*[^0-9a-f]*'`,
|
||||
),
|
||||
check(
|
||||
'ql3_legacy_data_directory_adoption_count_check',
|
||||
sql`${table.secretCount} between 0 and case ${table.profile} when 'edge' then 128 else 512 end and ${table.environmentSecretCount} between 0 and ${table.secretCount} and ${table.sshSecretCount} between 0 and ${table.secretCount} and ${table.environmentSecretCount} + ${table.sshSecretCount} = ${table.secretCount}`,
|
||||
),
|
||||
check(
|
||||
'ql3_legacy_data_directory_adoption_model_check',
|
||||
sql`length(cast(${table.modelJson} as blob)) between 2 and 1048576 and json_valid(${table.modelJson}) and json_type(${table.modelJson}) = 'object' and json_extract(${table.modelJson}, '$.schema') = 'qinglong/legacy-data-directory-applied-model@v1' and json_extract(${table.modelJson}, '$.activation') = 'disabled' and json_extract(${table.modelJson}, '$.config.schema') = 'qinglong/legacy-config-transformation@v1' and json_extract(${table.modelJson}, '$.config.activation') = 'disabled' and json_extract(${table.modelJson}, '$.keyv.schema') = 'qinglong/legacy-keyv-transformation@v1' and json_extract(${table.modelJson}, '$.keyv.activation') = 'disabled' and json_extract(${table.modelJson}, '$.ssh.schema') = 'qinglong/legacy-ssh-transformation@v1' and json_extract(${table.modelJson}, '$.ssh.activation') = 'disabled' and json_extract(${table.modelJson}, '$.manualReview.schema') = 'qinglong/legacy-data-directory-manual-review@v1' and json_extract(${table.modelJson}, '$.manualReview.required') = 0 and json_extract(${table.modelJson}, '$.manualReview.activation') = 'disabled'`,
|
||||
),
|
||||
check(
|
||||
'ql3_legacy_data_directory_adoption_receipt_check',
|
||||
sql`length(cast(${table.receiptJson} as blob)) between 2 and 1048576 and json_valid(${table.receiptJson}) and json_type(${table.receiptJson}) = 'object' and json_extract(${table.receiptJson}, '$.schema') = 'qinglong/legacy-data-directory-adoption-receipt@v1' and json_extract(${table.receiptJson}, '$.mutationId') = ${table.mutationId} and json_extract(${table.receiptJson}, '$.projectId') = ${table.projectId} and json_extract(${table.receiptJson}, '$.profile') = ${table.profile} and json_extract(${table.receiptJson}, '$.sourceStageManifestDigest') = ${table.sourceStageManifestDigest} and json_extract(${table.receiptJson}, '$.transformationDigest') = ${table.transformationDigest} and json_extract(${table.receiptJson}, '$.modelDigest') = ${table.modelDigest} and json_extract(${table.receiptJson}, '$.secretCount') = ${table.secretCount} and json_extract(${table.receiptJson}, '$.environmentSecretCount') = ${table.environmentSecretCount} and json_extract(${table.receiptJson}, '$.sshSecretCount') = ${table.sshSecretCount} and json_extract(${table.receiptJson}, '$.publicationDigest') = ${table.publicationDigest} and json_extract(${table.receiptJson}, '$.auditEventId') = ${table.auditEventId} and json_extract(${table.receiptJson}, '$.committedAtMs') = ${table.committedAtMs} and json_extract(${table.receiptJson}, '$.receiptDigest') = ${table.receiptDigest}`,
|
||||
),
|
||||
check(
|
||||
'ql3_legacy_data_directory_adoption_time_check',
|
||||
sql`${table.committedAtMs} >= 0`,
|
||||
),
|
||||
uniqueIndex('ql3_legacy_data_directory_adoption_transformation_uidx').on(
|
||||
table.transformationDigest,
|
||||
),
|
||||
uniqueIndex('ql3_legacy_data_directory_adoption_receipt_uidx').on(
|
||||
table.receiptDigest,
|
||||
),
|
||||
index('ql3_legacy_data_directory_adoption_project_time_idx').on(
|
||||
table.projectId,
|
||||
sql`${table.committedAtMs} desc`,
|
||||
sql`${table.mutationId} desc`,
|
||||
),
|
||||
],
|
||||
);
|
||||
|
||||
export const legacyDataDirectoryAdoptionSecrets = sqliteTable(
|
||||
'QingLong3LegacyDataDirectoryAdoptionSecrets',
|
||||
{
|
||||
adoptionMutationId: text('adoption_mutation_id').notNull(),
|
||||
ordinal: integer('ordinal').notNull(),
|
||||
projectId: text('project_id').notNull(),
|
||||
kind: text('kind').notNull(),
|
||||
sourceNameDigest: text('source_name_digest').notNull(),
|
||||
secretName: text('secret_name').notNull(),
|
||||
secretVersion: integer('secret_version').notNull(),
|
||||
secretMutationId: text('secret_mutation_id')
|
||||
.notNull()
|
||||
.references(() => localSecurityAuditEvents.eventId, {
|
||||
onDelete: 'restrict',
|
||||
onUpdate: 'restrict',
|
||||
}),
|
||||
valueFile: text('value_file').notNull(),
|
||||
valueDigest: text('value_digest').notNull(),
|
||||
secretRef: text('secret_ref').notNull(),
|
||||
itemDigest: text('item_digest').notNull(),
|
||||
},
|
||||
(table) => [
|
||||
primaryKey({ columns: [table.adoptionMutationId, table.ordinal] }),
|
||||
foreignKey({
|
||||
columns: [table.adoptionMutationId],
|
||||
foreignColumns: [legacyDataDirectoryAdoptions.mutationId],
|
||||
name: 'ql3_legacy_data_directory_adoption_secret_parent_fk',
|
||||
})
|
||||
.onDelete('restrict')
|
||||
.onUpdate('restrict'),
|
||||
foreignKey({
|
||||
columns: [table.projectId, table.secretName, table.secretVersion],
|
||||
foreignColumns: [
|
||||
localSecretEnvelopes.projectId,
|
||||
localSecretEnvelopes.name,
|
||||
localSecretEnvelopes.version,
|
||||
],
|
||||
name: 'ql3_legacy_data_directory_adoption_secret_envelope_fk',
|
||||
})
|
||||
.onDelete('restrict')
|
||||
.onUpdate('restrict'),
|
||||
check(
|
||||
'ql3_legacy_data_directory_adoption_secret_identity_check',
|
||||
sql`${table.ordinal} between 1 and 512 and length(${table.projectId}) between 1 and 128 and ${table.kind} in ('environment', 'ssh_private_key') and length(${table.secretName}) between 1 and 128 and ${table.secretVersion} = 1 and length(${table.secretMutationId}) = 36 and substr(${table.secretMutationId}, 15, 1) = '4' and replace(${table.secretMutationId}, '-', '') not glob '*[^0-9a-f]*' and length(${table.valueFile}) = 83 and ${table.valueFile} glob 'secret-values/[0-9a-f]*.json' and length(${table.secretRef}) between 1 and 512`,
|
||||
),
|
||||
check(
|
||||
'ql3_legacy_data_directory_adoption_secret_digest_check',
|
||||
sql`length(${table.sourceNameDigest}) = 64 and ${table.sourceNameDigest} not glob '*[^0-9a-f]*' and length(${table.valueDigest}) = 64 and ${table.valueDigest} not glob '*[^0-9a-f]*' and length(${table.itemDigest}) = 64 and ${table.itemDigest} not glob '*[^0-9a-f]*'`,
|
||||
),
|
||||
uniqueIndex('ql3_legacy_data_directory_adoption_secret_name_uidx').on(
|
||||
table.adoptionMutationId,
|
||||
table.secretName,
|
||||
),
|
||||
uniqueIndex('ql3_legacy_data_directory_adoption_secret_mutation_uidx').on(
|
||||
table.secretMutationId,
|
||||
),
|
||||
uniqueIndex('ql3_legacy_data_directory_adoption_secret_item_uidx').on(
|
||||
table.itemDigest,
|
||||
),
|
||||
],
|
||||
);
|
||||
|
||||
export const localIdentitySubjects = sqliteTable(
|
||||
'QingLong3IdentitySubjects',
|
||||
{
|
||||
@@ -5042,6 +5180,8 @@ export const localSqliteSchema = Object.freeze({
|
||||
toolExecutionResultRekeyHeads,
|
||||
toolResultKeyRetirementReceipts,
|
||||
legacyAdoptions,
|
||||
legacyDataDirectoryAdoptions,
|
||||
legacyDataDirectoryAdoptionSecrets,
|
||||
localIdentitySubjects,
|
||||
localApiCredentials,
|
||||
localApiCredentialPepperBindings,
|
||||
|
||||
Reference in New Issue
Block a user