open-source/qinglong
1
0
Fork 0
mirror of https://github.com/whyour/qinglong.git synced 2026-09-23 03:18:09 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(ql3): materialize package secret bindings

Browse Source
This commit is contained in:
whyour
2026-08-13 10:31:06 +08:00
parent 55ef085a6e
commit d72631a2b0
34 changed files with 839 additions and 115 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/ql3-cluster-postgres/test/postgresqlMigrationDefinitions.test.cjs
+42
View File
@@ -110,6 +110,7 @@ test('defines the immutable PostgreSQL capability and Run core stream', async ()
'pg-0057-run-management-stop-boundary',
'pg-0058-plugin-package-automation-disposition-events',
'pg-0059-plugin-package-secret-bindings',
'pg-0060-plugin-package-secret-materialization-guard',
],
);
for (const migration of postgresqlMainMigrationStream.migrations) {
@@ -541,6 +542,11 @@ test('freezes every published PostgreSQL migration checksum', () => {
checksum:
'87582d256c868bd7f5af352c4b052fdab9f3714e1e7179e35d33bfa5d62957be',
},
{
id: 'pg-0060-plugin-package-secret-materialization-guard',
checksum:
'28284ca860b39ff9de5b2aa1a2a60ef2c463fd6a72798d237040174272b64b1e',
},
];
assert.deepEqual(
postgresqlMainMigrationStream.migrations.map(({ id, checksum }) => ({
@@ -1988,3 +1994,39 @@ test('advances capability v58 with immutable generation-bound Package Secret bin
/migration_id = 'pg-0058-plugin-package-automation-disposition-events'/,
);
});
test('advances capability v59 with fail-closed Package Secret materialization', async () => {
const migration = migrationById(
'pg-0060-plugin-package-secret-materialization-guard',
);
const statements = [];
await migration.up({
async query(statement) {
statements.push(statement);
return { rows: [] };
},
});
const sql = statements.join('\n');
assert.match(
sql,
/CREATE FUNCTION "ql3"\."enforce_plugin_package_secret_materialization"\(\)/,
);
assert.match(
sql,
/jsonb_typeof\([\s\S]+IS DISTINCT FROM 'array'[\s\S]+permission declarations are malformed/,
);
assert.match(sql, /unresolved Package Secret placeholder/);
assert.match(sql, /Task SecretRef is outside Package binding/);
assert.match(
sql,
/CREATE TRIGGER ql3_plugin_package_secret_materialization_guard BEFORE INSERT/,
);
assert.match(
sql,
/REVOKE ALL ON FUNCTION [^;]+ FROM PUBLIC, ql3_runtime, ql3_admin, ql3_package_manager, ql3_package_executor, ql3_worker_ingress/,
);
assert.match(sql, /contract_version = 59/);
assert.match(sql, /"plugin_package_secret_materialization":1/);
assert.match(sql, /contract_version = 58/);
assert.match(sql, /migration_id = 'pg-0059-plugin-package-secret-bindings'/);
});
packages/ql3-cluster-postgres/test/postgresqlSchemaReadiness.test.cjs
+12 -11
View File
@@ -754,7 +754,7 @@ test('accepts the exact PostgreSQL control schema and least-privilege runtime ro
serverMajor: 16,
currentUser: 'ql3_runtime',
contractName: 'control-core',
contractVersion: 58,
contractVersion: 59,
migrationIds: [
'pg-0001-schema-capability',
'pg-0002-run-core',
@@ -815,6 +815,7 @@ test('accepts the exact PostgreSQL control schema and least-privilege runtime ro
'pg-0057-run-management-stop-boundary',
'pg-0058-plugin-package-automation-disposition-events',
'pg-0059-plugin-package-secret-bindings',
'pg-0060-plugin-package-secret-materialization-guard',
],
});
});
@@ -845,10 +846,10 @@ test('accepts the exact schema and isolated least-privilege admin role', async (
}),
);
assert.equal(report.currentUser, 'ql3_admin');
assert.equal(report.contractVersion, 58);
assert.equal(report.contractVersion, 59);
assert.equal(
report.migrationIds.at(-1),
'pg-0059-plugin-package-secret-bindings',
'pg-0060-plugin-package-secret-materialization-guard',
);
});
@@ -861,10 +862,10 @@ test('accepts the isolated least-privilege automation manager role', async () =>
}),
);
assert.equal(report.currentUser, 'ql3_automation_manager');
assert.equal(report.contractVersion, 58);
assert.equal(report.contractVersion, 59);
assert.equal(
report.migrationIds.at(-1),
'pg-0059-plugin-package-secret-bindings',
'pg-0060-plugin-package-secret-materialization-guard',
);
const widened = automationManagerPrivileges();
@@ -893,10 +894,10 @@ test('accepts the isolated least-privilege human Approval manager role', async (
}),
);
assert.equal(report.currentUser, 'ql3_approval_manager');
assert.equal(report.contractVersion, 58);
assert.equal(report.contractVersion, 59);
assert.equal(
report.migrationIds.at(-1),
'pg-0059-plugin-package-secret-bindings',
'pg-0060-plugin-package-secret-materialization-guard',
);
const widened = approvalManagerPrivileges();
@@ -927,10 +928,10 @@ test('accepts the isolated least-privilege Run manager role', async () => {
}),
);
assert.equal(report.currentUser, 'ql3_run_manager');
assert.equal(report.contractVersion, 58);
assert.equal(report.contractVersion, 59);
assert.equal(
report.migrationIds.at(-1),
'pg-0059-plugin-package-secret-bindings',
'pg-0060-plugin-package-secret-materialization-guard',
);
const widened = runManagerPrivileges();
@@ -1062,10 +1063,10 @@ test('accepts the exact schema and isolated Worker ingress role', async () => {
}),
);
assert.equal(report.currentUser, 'ql3_worker_ingress');
assert.equal(report.contractVersion, 58);
assert.equal(report.contractVersion, 59);
assert.equal(
report.migrationIds.at(-1),
'pg-0059-plugin-package-secret-bindings',
'pg-0060-plugin-package-secret-materialization-guard',
);
});