open-source/qinglong
1
0
Fork 0
mirror of https://github.com/whyour/qinglong.git synced 2026-09-22 02:27:44 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(ql3): add strong cluster run stop

Browse Source
This commit is contained in:
whyour
2026-08-12 08:21:28 +08:00
parent c0ab62e64a
commit dd370b2842
22 changed files with 1602 additions and 321 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/ql3-cluster-postgres/test/postgresqlSchemaReadiness.test.cjs
+71 -23
View File
@@ -13,7 +13,9 @@ const {
assertPostgresWorkerCredentialManagerSchemaReady,
assertPostgresWorkerIngressSchemaReady,
} = require('../dist/schema/schemaReadiness');
const { postgresqlControlSchemaContract } = require('../dist/schema/schemaContract');
const {
postgresqlControlSchemaContract,
} = require('../dist/schema/schemaContract');
const { postgresqlMainMigrationStream } = require('../dist/migrations');
function validHistory() {
@@ -86,12 +88,7 @@ function validPrivileges() {
plugin_package_automation_publication_heads: [true, false, false, false],
plugin_package_workflow_admissions: [true, true, false, false],
plugin_package_workflow_admission_steps: [true, true, false, false],
plugin_package_workflow_task_attempt_admissions: [
true,
true,
false,
false,
],
plugin_package_workflow_task_attempt_admissions: [true, true, false, false],
plugin_package_publisher_provenance: [false, false, false, false],
plugin_package_publisher_revocation_receipts: [false, false, false, false],
plugin_package_publisher_revocation_impacts: [false, false, false, false],
@@ -523,11 +520,11 @@ function workerCredentialPrivileges(kind) {
]
: []),
...(manager
? []
: [
'approved_action_dispatches',
'approved_action_executions',
'worker_credentials',
? []
: [
'approved_action_dispatches',
'approved_action_executions',
'worker_credentials',
'worker_credential_mutations',
'worker_credential_deliveries',
'worker_credential_stage_discards',
@@ -714,6 +711,26 @@ function queryable(overrides = {}) {
],
};
}
if (text.includes('has_column_privilege')) {
assert.match(text, /format\('%I\.%I', \$1::text, 'runs'\)/);
const columns = contract.tables.find(
({ name }) => name === 'runs',
).columns;
const allowed = new Set([
'cancel_requested_at_ms',
'cancel_reason',
'version',
'event_sequence',
]);
return {
rows:
overrides.runManagerColumnPrivileges ??
columns.map((columnName) => ({
columnName,
updateAllowed: allowed.has(columnName),
})),
};
}
if (text.includes('has_table_privilege')) {
return { rows: overrides.privileges ?? validPrivileges() };
}
@@ -731,7 +748,7 @@ test('accepts the exact PostgreSQL control schema and least-privilege runtime ro
serverMajor: 16,
currentUser: 'ql3_runtime',
contractName: 'control-core',
contractVersion: 55,
contractVersion: 56,
migrationIds: [
'pg-0001-schema-capability',
'pg-0002-run-core',
@@ -789,6 +806,7 @@ test('accepts the exact PostgreSQL control schema and least-privilege runtime ro
'pg-0054-approval-management-boundary',
'pg-0055-run-attempt-log-retention',
'pg-0056-run-management-boundary',
'pg-0057-run-management-stop-boundary',
],
});
});
@@ -819,10 +837,10 @@ test('accepts the exact schema and isolated least-privilege admin role', async (
}),
);
assert.equal(report.currentUser, 'ql3_admin');
assert.equal(report.contractVersion, 55);
assert.equal(report.contractVersion, 56);
assert.equal(
report.migrationIds.at(-1),
'pg-0056-run-management-boundary',
'pg-0057-run-management-stop-boundary',
);
});
@@ -835,10 +853,10 @@ test('accepts the isolated least-privilege automation manager role', async () =>
}),
);
assert.equal(report.currentUser, 'ql3_automation_manager');
assert.equal(report.contractVersion, 55);
assert.equal(report.contractVersion, 56);
assert.equal(
report.migrationIds.at(-1),
'pg-0056-run-management-boundary',
'pg-0057-run-management-stop-boundary',
);
const widened = automationManagerPrivileges();
@@ -867,10 +885,10 @@ test('accepts the isolated least-privilege human Approval manager role', async (
}),
);
assert.equal(report.currentUser, 'ql3_approval_manager');
assert.equal(report.contractVersion, 55);
assert.equal(report.contractVersion, 56);
assert.equal(
report.migrationIds.at(-1),
'pg-0056-run-management-boundary',
'pg-0057-run-management-stop-boundary',
);
const widened = approvalManagerPrivileges();
@@ -901,8 +919,11 @@ test('accepts the isolated least-privilege Run manager role', async () => {
}),
);
assert.equal(report.currentUser, 'ql3_run_manager');
assert.equal(report.contractVersion, 55);
assert.equal(report.migrationIds.at(-1), 'pg-0056-run-management-boundary');
assert.equal(report.contractVersion, 56);
assert.equal(
report.migrationIds.at(-1),
'pg-0057-run-management-stop-boundary',
);
const widened = runManagerPrivileges();
widened.find(({ tableName }) => tableName === 'runs').updateAllowed = true;
@@ -919,6 +940,33 @@ test('accepts the isolated least-privilege Run manager role', async () => {
error.code === 'run_manager_role_invalid' &&
error.facts.includes('table-privileges:runs'),
);
const widenedColumns = postgresqlControlSchemaContract.tables
.find(({ name }) => name === 'runs')
.columns.map((columnName) => ({
columnName,
updateAllowed: [
'cancel_requested_at_ms',
'cancel_reason',
'version',
'event_sequence',
'status',
].includes(columnName),
}));
await assert.rejects(
assertPostgresRunManagerSchemaReady(
queryable({
currentUser: 'ql3_run_manager',
privileges: runManagerPrivileges(),
functionMode: 'run-manager',
runManagerColumnPrivileges: widenedColumns,
}),
),
(error) =>
error instanceof PostgresSchemaReadinessError &&
error.code === 'run_manager_role_invalid' &&
error.facts.includes('column-update-privilege:runs.status'),
);
});
test('accepts isolated Package manager and executor roles', async () => {
@@ -1006,10 +1054,10 @@ test('accepts the exact schema and isolated Worker ingress role', async () => {
}),
);
assert.equal(report.currentUser, 'ql3_worker_ingress');
assert.equal(report.contractVersion, 55);
assert.equal(report.contractVersion, 56);
assert.equal(
report.migrationIds.at(-1),
'pg-0056-run-management-boundary',
'pg-0057-run-management-stop-boundary',
);
});