open-source/qinglong
1
0
Fork 0
mirror of https://github.com/whyour/qinglong.git synced 2026-09-20 16:07:11 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(ql3): bound secret config auth namespaces

Browse Source
This commit is contained in:
whyour
2026-09-02 07:18:07 +08:00
parent 53672c468b
commit f76e5f16da
3 changed files with 23 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/ql3-local-owner-cli/src/deployment/reconciliation/application/secret-and-config/application/coordinator.ts
+1 -1
View File
@@ -226,7 +226,7 @@ async function authenticate(
databasePath: options.targetDatabasePath, databasePath: options.targetDatabasePath,
ownerPepperKeyringDirectory: options.ownerPepperKeyringDirectory, ownerPepperKeyringDirectory: options.ownerPepperKeyringDirectory,
credentialFilePath: options.credentialFilePath, credentialFilePath: options.credentialFilePath,
authenticationNamespace: 'local_reconciliation_secret_config_apply', authenticationNamespace: 'reconcile_secret_config_apply',
now: () => atMs, now: () => atMs,
}); });
assertReviewer(authenticated, reviewer, atMs); assertReviewer(authenticated, reviewer, atMs);
packages/ql3-local-owner-cli/src/deployment/reconciliation/application/secret-and-config/decisionCoordinator.ts
+1 -1
View File
@@ -766,7 +766,7 @@ async function authorization(
databasePath: command.options.targetDatabasePath, databasePath: command.options.targetDatabasePath,
ownerPepperKeyringDirectory: command.options.ownerPepperKeyringDirectory, ownerPepperKeyringDirectory: command.options.ownerPepperKeyringDirectory,
credentialFilePath: command.options.credentialFilePath, credentialFilePath: command.options.credentialFilePath,
authenticationNamespace: 'local_reconciliation_secret_config', authenticationNamespace: 'reconcile_secret_config_decision',
now: () => command.request.committedAtMs, now: () => command.request.committedAtMs,
}); });
const reviewer = strongReviewer( const reviewer = strongReviewer(
packages/ql3-local-owner-cli/test/reconciliationCapturePrepare.test.cjs
+21 -5
View File
@@ -1887,9 +1887,13 @@ function secretConfigDecisionCommitFixture(
}, },
async authenticate(_database, authenticateOptions) { async authenticate(_database, authenticateOptions) {
authentications += 1; authentications += 1;
assert.match(
authenticateOptions.authenticationNamespace,
/^[a-z][a-z0-9_]{0,31}$/,
);
assert.equal( assert.equal(
authenticateOptions.authenticationNamespace, authenticateOptions.authenticationNamespace,
'local_reconciliation_secret_config', 'reconcile_secret_config_decision',
); );
return { return {
principal: { principal: {
@@ -1897,7 +1901,7 @@ function secretConfigDecisionCommitFixture(
type: 'user', type: 'user',
id: options.reviewerId ?? 'review-owner', id: options.reviewerId ?? 'review-owner',
}, },
authenticationId: 'local_reconciliation_secret_config:test', authenticationId: 'reconcile_secret_config_decision:test',
authenticatedAtMs: committedAtMs, authenticatedAtMs: committedAtMs,
expiresAtMs: committedAtMs + authorizationLifetimeMs + 60_000, expiresAtMs: committedAtMs + authorizationLifetimeMs + 60_000,
assurance: options.assurance ?? 'local_console', assurance: options.assurance ?? 'local_console',
@@ -2107,11 +2111,19 @@ async function appliedSecretConfigFixture(t, options = {}) {
return { async close() {} }; return { async close() {} };
}, },
async authenticate(_database, authenticationOptions) { async authenticate(_database, authenticationOptions) {
assert.match(
authenticationOptions.authenticationNamespace,
/^[a-z][a-z0-9_]{0,31}$/,
);
assert.equal(
authenticationOptions.authenticationNamespace,
'reconcile_secret_config_apply',
);
const authenticatedAtMs = authenticationOptions.now(); const authenticatedAtMs = authenticationOptions.now();
return { return {
principal: { principal: {
subject: { type: 'user', id: 'review-owner' }, subject: { type: 'user', id: 'review-owner' },
authenticationId: 'local_reconciliation_secret_config_apply:test', authenticationId: 'reconcile_secret_config_apply:test',
authenticatedAtMs, authenticatedAtMs,
expiresAtMs: authenticatedAtMs + 60 * 60 * 1_000, expiresAtMs: authenticatedAtMs + 60 * 60 * 1_000,
assurance: 'local_console', assurance: 'local_console',
@@ -4503,15 +4515,19 @@ test('Secret/Config apply publishes encrypted material atomically and recovers e
}, },
async authenticate(_database, options) { async authenticate(_database, options) {
authentications += 1; authentications += 1;
assert.match(
options.authenticationNamespace,
/^[a-z][a-z0-9_]{0,31}$/,
);
assert.equal( assert.equal(
options.authenticationNamespace, options.authenticationNamespace,
'local_reconciliation_secret_config_apply', 'reconcile_secret_config_apply',
); );
const authenticatedAtMs = options.now(); const authenticatedAtMs = options.now();
return { return {
principal: { principal: {
subject: { type: 'user', id: 'review-owner' }, subject: { type: 'user', id: 'review-owner' },
authenticationId: 'local_reconciliation_secret_config_apply:test', authenticationId: 'reconcile_secret_config_apply:test',
authenticatedAtMs, authenticatedAtMs,
expiresAtMs: authenticatedAtMs + 60 * 60 * 1_000, expiresAtMs: authenticatedAtMs + 60 * 60 * 1_000,
assurance: 'local_console', assurance: 'local_console',