feat(ql3): materialize package secret bindings

packages/ql3-cluster-admin/src/plugin-package/recovery/pluginPackageRecovery.ts

@@ -39,6 +39,7 @@ import {
   assertPostgresPackageExecutorSchemaReady,
   PostgresPluginPackageAutomationPublicationRepository,
   PostgresPluginPackageMaterializedRevisionRepository,
+  PostgresPluginPackageSecretBindingRepository,
   PostgresPluginPackagePublisherProvenanceRepository,
   PostgresPluginPackageTaskReconciliationRepository,
   PostgresProjectToolDefinitionSnapshotRepository,
@@ -102,8 +103,7 @@ export class ClusterPluginPackagePublisherProvenanceRecoveryRequiredError extend
     readonly recovery: Readonly<ClusterPluginPackagePublisherProvenanceRecoveryResult>,
   ) {
     super('Cluster has unresolved Plugin Package publisher provenance work');
-    this.name =
-      'ClusterPluginPackagePublisherProvenanceRecoveryRequiredError';
+    this.name = 'ClusterPluginPackagePublisherProvenanceRecoveryRequiredError';
   }
 }
 
@@ -166,9 +166,7 @@ function assertOptions(options: ClusterPluginPackageRecoveryOptions): void {
       (!options.resourceByteSource ||
         typeof options.resourceByteSource.open !== 'function')) ||
     typeof options.trustAuthorityId !== 'string' ||
-    !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(
-      options.trustAuthorityId,
-    ) ||
+    !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(options.trustAuthorityId) ||
     typeof options.now !== 'function' ||
     (options.pageSize !== undefined &&
       (!Number.isSafeInteger(options.pageSize) ||
@@ -313,8 +311,7 @@ export async function recoverClusterPluginPackages(
     const resourceByteSource =
       options.resourceByteSource ??
       new ClusterPluginPackageOciResourceByteSource({
-        authority:
-          stageAuthority as ClusterPluginPackageOciStageAuthority,
+        authority: stageAuthority as ClusterPluginPackageOciStageAuthority,
         lockSource: repository,
       });
     const recovery = await new PluginPackageRecoveryCoordinator({
@@ -340,6 +337,8 @@ export async function recoverClusterPluginPackages(
         database.pool,
         taskSpecSemanticRegistry,
       );
+    const secretBindingRepository =
+      new PostgresPluginPackageSecretBindingRepository(database.pool);
     const taskPublicationRecovery =
       await new PluginPackageTaskPublicationRecoveryCoordinator({
         source: taskReconciliationRepository,
@@ -348,6 +347,7 @@ export async function recoverClusterPluginPackages(
           lockSource: repository,
           byteSource: resourceByteSource,
           materializedRepository,
+          secretBindingSource: secretBindingRepository,
           reconciliationRepository: taskReconciliationRepository,
           taskSpecSemanticRegistry,
         }),

packages/ql3-cluster-admin/test/bootstrap.test.cjs

@@ -160,6 +160,7 @@ function database(serverVersionNum = '160014') {
                 'commit_plugin_package_lifecycle',
                 'commit_plugin_package_task_reconciliation',
                 'commit_plugin_package_quarantine',
+                'enforce_plugin_package_secret_materialization',
                 'enforce_plugin_package_stage_provenance',
                 'lock_active_plugin_package_project',
                 'lock_approval_policy_fence',

packages/ql3-cluster-admin/test/pluginPackageRecovery.test.cjs

@@ -192,6 +192,7 @@ function database(serverVersionNum = '160014') {
             rows: contract.functions.map(({ name: functionName }) => ({
               functionName,
               executeAllowed: ![
+                'enforce_plugin_package_secret_materialization',
                 'enforce_plugin_package_stage_provenance',
                 'plugin_package_automation_start_allowed',
                 'plugin_package_run_start_allowed',