mirror of
https://github.com/whyour/qinglong.git
synced 2026-09-22 10:32:40 +08:00
feat(ql3): add strong cluster run stop
This commit is contained in:
whyour
@@ -41,25 +41,38 @@ function fixture(options = {}) {
|
||||
const normalized = sql.replace(/\s+/g, ' ').trim();
|
||||
calls.push({ sql: normalized, params });
|
||||
if (
|
||||
normalized.startsWith('BEGIN') || normalized === 'COMMIT' ||
|
||||
normalized === 'ROLLBACK' || normalized.startsWith('SELECT set_config')
|
||||
) return { rows: [], rowCount: 0 };
|
||||
normalized.startsWith('BEGIN') ||
|
||||
normalized === 'COMMIT' ||
|
||||
normalized === 'ROLLBACK' ||
|
||||
normalized.startsWith('SELECT set_config')
|
||||
)
|
||||
return { rows: [], rowCount: 0 };
|
||||
if (normalized.includes('lock_run_management_policy_fence')) {
|
||||
return {
|
||||
rows: [{ matches: options.policyMatches ?? true }],
|
||||
rowCount: 1,
|
||||
};
|
||||
}
|
||||
if (normalized.includes('FROM "ql3"."projects"')) {
|
||||
return {
|
||||
rows: options.projectRows ?? [{
|
||||
projectStatus: 'active',
|
||||
projectVersion: 2,
|
||||
}],
|
||||
rows: options.projectRows ?? [
|
||||
{
|
||||
projectStatus: 'active',
|
||||
projectVersion: 2,
|
||||
},
|
||||
],
|
||||
rowCount: 1,
|
||||
};
|
||||
}
|
||||
if (normalized.includes('FROM "ql3"."project_role_bindings"')) {
|
||||
return {
|
||||
rows: options.bindingRows ?? [{
|
||||
bindingVersion: 3,
|
||||
bindingState: 'active',
|
||||
bindingRole: 'operator',
|
||||
}],
|
||||
rows: options.bindingRows ?? [
|
||||
{
|
||||
bindingVersion: 3,
|
||||
bindingState: 'active',
|
||||
bindingRole: 'operator',
|
||||
},
|
||||
],
|
||||
rowCount: 1,
|
||||
};
|
||||
}
|
||||
@@ -73,9 +86,7 @@ function fixture(options = {}) {
|
||||
};
|
||||
}
|
||||
if (
|
||||
normalized.includes(
|
||||
'FROM "ql3"."plugin_package_workflow_admissions"',
|
||||
)
|
||||
normalized.includes('FROM "ql3"."plugin_package_workflow_admissions"')
|
||||
) {
|
||||
const rows = options.workflowAdmissionRows ?? [
|
||||
{
|
||||
@@ -91,25 +102,40 @@ function fixture(options = {}) {
|
||||
}
|
||||
if (normalized.startsWith('UPDATE "ql3"."runs"')) {
|
||||
return {
|
||||
rows: options.updatedRows ?? [run({
|
||||
runVersion: 5,
|
||||
eventSequence: 7,
|
||||
cancelRequestedAtMs: options.nowMs ?? 1_000,
|
||||
cancelReason: 'user',
|
||||
})],
|
||||
rows: options.updatedRows ?? [
|
||||
run({
|
||||
runVersion: 5,
|
||||
eventSequence: 7,
|
||||
cancelRequestedAtMs: options.nowMs ?? 1_000,
|
||||
cancelReason: 'user',
|
||||
}),
|
||||
],
|
||||
rowCount: options.updatedRows?.length ?? 1,
|
||||
};
|
||||
}
|
||||
if (normalized.startsWith('INSERT INTO "ql3"."run_events"')) {
|
||||
return { rows: [], rowCount: 1 };
|
||||
}
|
||||
if (normalized.startsWith('INSERT INTO "ql3"."security_audit_events"')) {
|
||||
return {
|
||||
rows: options.auditInserted === false ? [] : [{ eventId: params[0] }],
|
||||
rowCount: options.auditInserted === false ? 0 : 1,
|
||||
};
|
||||
}
|
||||
if (normalized.includes('FROM "ql3"."security_audit_events"')) {
|
||||
return { rows: options.auditReplayRows ?? [], rowCount: 0 };
|
||||
}
|
||||
throw new Error(`Unexpected SQL: ${normalized}`);
|
||||
},
|
||||
release() { calls.push({ sql: 'RELEASE', params: [] }); },
|
||||
release() {
|
||||
calls.push({ sql: 'RELEASE', params: [] });
|
||||
},
|
||||
};
|
||||
return {
|
||||
repository: new PostgresClusterRunCancellationRepository({
|
||||
async connect() { return client; },
|
||||
async connect() {
|
||||
return client;
|
||||
},
|
||||
}),
|
||||
calls,
|
||||
};
|
||||
@@ -127,23 +153,26 @@ test('revalidates policy authority and commits one database-timed intent', async
|
||||
cancelRequestedAtMs: 1_000,
|
||||
cancelReason: 'user',
|
||||
});
|
||||
const projectIndex = calls.findIndex(({ sql }) =>
|
||||
sql.includes('FROM "ql3"."projects"'));
|
||||
const bindingIndex = calls.findIndex(({ sql }) =>
|
||||
sql.includes('FROM "ql3"."project_role_bindings"'));
|
||||
const policyIndex = calls.findIndex(({ sql }) =>
|
||||
sql.includes('lock_run_management_policy_fence'),
|
||||
);
|
||||
const runIndex = calls.findIndex(({ sql }) =>
|
||||
sql.includes('FROM "ql3"."runs"'));
|
||||
assert.ok(projectIndex < bindingIndex && bindingIndex < runIndex);
|
||||
const update = calls.find(({ sql }) =>
|
||||
sql.startsWith('UPDATE "ql3"."runs"'));
|
||||
sql.includes('FROM "ql3"."runs"'),
|
||||
);
|
||||
assert.ok(policyIndex >= 0 && policyIndex < runIndex);
|
||||
const update = calls.find(({ sql }) => sql.startsWith('UPDATE "ql3"."runs"'));
|
||||
assert.deepEqual(update.params, ['run-1', 1_000, 5, 7, 4]);
|
||||
const event = calls.find(({ sql }) =>
|
||||
sql.startsWith('INSERT INTO "ql3"."run_events"'));
|
||||
sql.startsWith('INSERT INTO "ql3"."run_events"'),
|
||||
);
|
||||
assert.equal(event.params[0], command().eventId);
|
||||
assert.equal(event.params[3], 'user-cancel:mutation-1');
|
||||
assert.equal(event.params[4], 'user');
|
||||
assert.equal(JSON.parse(event.params[6]).reason, 'user');
|
||||
assert.equal(calls.some(({ sql }) => sql === 'COMMIT'), true);
|
||||
assert.equal(
|
||||
calls.some(({ sql }) => sql === 'COMMIT'),
|
||||
true,
|
||||
);
|
||||
});
|
||||
|
||||
test('returns existing intent and terminal state without adding an event', async () => {
|
||||
@@ -154,8 +183,12 @@ test('returns existing intent and terminal state without adding an event', async
|
||||
(await existing.repository.requestUserCancellation(command())).status,
|
||||
'already_requested',
|
||||
);
|
||||
assert.equal(existing.calls.some(({ sql }) =>
|
||||
sql.startsWith('INSERT INTO "ql3"."run_events"')), false);
|
||||
assert.equal(
|
||||
existing.calls.some(({ sql }) =>
|
||||
sql.startsWith('INSERT INTO "ql3"."run_events"'),
|
||||
),
|
||||
false,
|
||||
);
|
||||
|
||||
const terminal = fixture({
|
||||
runRows: [run({ runStatus: 'succeeded', runVersion: 5 })],
|
||||
@@ -164,20 +197,24 @@ test('returns existing intent and terminal state without adding an event', async
|
||||
(await terminal.repository.requestUserCancellation(command())).status,
|
||||
'already_terminal',
|
||||
);
|
||||
assert.equal(terminal.calls.some(({ sql }) =>
|
||||
sql.startsWith('UPDATE "ql3"."runs"')), false);
|
||||
assert.equal(
|
||||
terminal.calls.some(({ sql }) => sql.startsWith('UPDATE "ql3"."runs"')),
|
||||
false,
|
||||
);
|
||||
});
|
||||
|
||||
test('accepts cancellation for a lost Run that still owns retry authority', async () => {
|
||||
const { repository } = fixture({
|
||||
runRows: [run({ runStatus: 'lost' })],
|
||||
updatedRows: [run({
|
||||
runStatus: 'lost',
|
||||
runVersion: 5,
|
||||
eventSequence: 7,
|
||||
cancelRequestedAtMs: 1_000,
|
||||
cancelReason: 'user',
|
||||
})],
|
||||
updatedRows: [
|
||||
run({
|
||||
runStatus: 'lost',
|
||||
runVersion: 5,
|
||||
eventSequence: 7,
|
||||
cancelRequestedAtMs: 1_000,
|
||||
cancelReason: 'user',
|
||||
}),
|
||||
],
|
||||
});
|
||||
assert.equal(
|
||||
(await repository.requestUserCancellation(command())).status,
|
||||
@@ -187,11 +224,7 @@ test('accepts cancellation for a lost Run that still owns retry authority', asyn
|
||||
|
||||
test('rejects a revoked policy fence before locking the Run', async () => {
|
||||
const { repository, calls } = fixture({
|
||||
bindingRows: [{
|
||||
bindingVersion: 4,
|
||||
bindingState: 'revoked',
|
||||
bindingRole: null,
|
||||
}],
|
||||
policyMatches: false,
|
||||
});
|
||||
await assert.rejects(
|
||||
repository.requestUserCancellation(command()),
|
||||
@@ -199,8 +232,78 @@ test('rejects a revoked policy fence before locking the Run', async () => {
|
||||
error instanceof ClusterRunCancellationFenceRejectedError &&
|
||||
error.reason === 'authorization_changed',
|
||||
);
|
||||
assert.equal(calls.some(({ sql }) => sql.includes('FROM "ql3"."runs"')), false);
|
||||
assert.equal(calls.some(({ sql }) => sql === 'ROLLBACK'), true);
|
||||
assert.equal(
|
||||
calls.some(({ sql }) => sql.includes('FROM "ql3"."runs"')),
|
||||
false,
|
||||
);
|
||||
assert.equal(
|
||||
calls.some(({ sql }) => sql === 'ROLLBACK'),
|
||||
true,
|
||||
);
|
||||
});
|
||||
|
||||
test('atomically records strong management audit and exact audit replay', async () => {
|
||||
const { repository, calls } = fixture();
|
||||
const { subject: _subject, ...baseCommand } = command();
|
||||
const managed = {
|
||||
...baseCommand,
|
||||
mutationId: '019f0000-0000-4000-8000-000000000001',
|
||||
requestId: 'request-stop-1',
|
||||
auditEventId: '019f0000-0000-4000-8000-000000000002',
|
||||
principal: {
|
||||
subject: command().subject,
|
||||
authenticationId: 'oidc:run-management-1',
|
||||
authenticatedAtMs: 900,
|
||||
expiresAtMs: 2_000,
|
||||
assurance: 'hardware',
|
||||
},
|
||||
};
|
||||
const result = await repository.requestUserCancellationAudited(managed);
|
||||
assert.equal(result.status, 'accepted');
|
||||
const audit = calls.find(({ sql }) =>
|
||||
sql.startsWith('INSERT INTO "ql3"."security_audit_events"'),
|
||||
);
|
||||
assert.equal(audit.params[0], managed.auditEventId);
|
||||
assert.equal(audit.params[1], managed.requestId);
|
||||
assert.equal(audit.params[5], managed.principal.authenticationId);
|
||||
assert.ok(
|
||||
calls.findIndex(({ sql }) => sql.startsWith('UPDATE "ql3"."runs"')) <
|
||||
calls.findIndex(({ sql }) =>
|
||||
sql.startsWith('INSERT INTO "ql3"."security_audit_events"'),
|
||||
),
|
||||
);
|
||||
assert.ok(
|
||||
calls.findIndex(({ sql }) =>
|
||||
sql.startsWith('INSERT INTO "ql3"."security_audit_events"'),
|
||||
) < calls.findIndex(({ sql }) => sql === 'COMMIT'),
|
||||
);
|
||||
|
||||
const replay = fixture({
|
||||
runRows: [run({ cancelRequestedAtMs: 1_000, cancelReason: 'user' })],
|
||||
auditInserted: false,
|
||||
auditReplayRows: [
|
||||
{
|
||||
requestId: managed.requestId,
|
||||
operationId: 'run.stop',
|
||||
projectId: managed.projectId,
|
||||
subjectType: 'user',
|
||||
subjectId: 'user-1',
|
||||
authenticationId: managed.principal.authenticationId,
|
||||
outcome: 'allowed',
|
||||
reasons: ['role_grant', 'strong_authentication'],
|
||||
projectVersion: 2,
|
||||
bindingVersion: 3,
|
||||
},
|
||||
],
|
||||
});
|
||||
assert.equal(
|
||||
(await replay.repository.requestUserCancellationAudited(managed)).status,
|
||||
'already_requested',
|
||||
);
|
||||
assert.equal(
|
||||
replay.calls.some(({ sql }) => sql.startsWith('UPDATE "ql3"."runs"')),
|
||||
false,
|
||||
);
|
||||
});
|
||||
|
||||
test('masks cross-Project and missing Runs', async () => {
|
||||
@@ -255,9 +358,7 @@ test('binds Workflow cancellation to the immutable admission target', async () =
|
||||
ClusterRunCancellationNotFoundError,
|
||||
);
|
||||
assert.equal(
|
||||
rejected.calls.some(({ sql }) =>
|
||||
sql.startsWith('UPDATE "ql3"."runs"'),
|
||||
),
|
||||
rejected.calls.some(({ sql }) => sql.startsWith('UPDATE "ql3"."runs"')),
|
||||
false,
|
||||
);
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user