mirror of
https://github.com/whyour/qinglong.git
synced 2026-09-20 16:07:11 +08:00
535 lines
16 KiB
JavaScript
535 lines
16 KiB
JavaScript
const assert = require('node:assert/strict');
|
|
const { spawnSync } = require('node:child_process');
|
|
const fs = require('node:fs');
|
|
const os = require('node:os');
|
|
const path = require('node:path');
|
|
const { DatabaseSync } = require('node:sqlite');
|
|
const { test } = require('node:test');
|
|
|
|
const {
|
|
createLocalTaskDefinitionCommandRunner,
|
|
runLocalTaskDefinitionCommandFile,
|
|
} = require('@qinglong/local-owner-cli/task-definition-command');
|
|
const {
|
|
provisionLocalOwnerPepperKey,
|
|
} = require('@qinglong/local-owner-console');
|
|
const {
|
|
createLocalTaskDefinitionAdministrationService,
|
|
} = require('@qinglong/local-admin/task-definition-administration');
|
|
const {
|
|
openLocalSqliteTaskDefinitionAdministrationDatabase,
|
|
} = require('@qinglong/local-sqlite/task-definition-administration');
|
|
const { migrateLocalSqlitePath } = require('@qinglong/local-sqlite/migration');
|
|
const {
|
|
apiCredentialSecretDigest,
|
|
formatApiCredentialToken,
|
|
} = require('@qinglong/runtime-core/api-credential-token');
|
|
|
|
const CREDENTIAL_ID = 'task-owner';
|
|
const PEPPER_KEY_ID = 'task-owner-v1';
|
|
const PEPPER = Buffer.alloc(32, 121).toString('base64url');
|
|
const CREDENTIAL_SECRET = Buffer.alloc(32, 122).toString('base64url');
|
|
const TOKEN = formatApiCredentialToken(CREDENTIAL_ID, CREDENTIAL_SECRET);
|
|
|
|
async function fixture(t, { role = 'owner' } = {}) {
|
|
const deploymentRoot = fs.mkdtempSync(
|
|
path.join(os.tmpdir(), 'ql3-task-command-'),
|
|
);
|
|
fs.chmodSync(deploymentRoot, 0o700);
|
|
t.after(() => fs.rmSync(deploymentRoot, { recursive: true, force: true }));
|
|
const commandsDirectory = path.join(deploymentRoot, 'commands');
|
|
const ownerPepperKeyringDirectory = path.join(deploymentRoot, 'owner-keys');
|
|
fs.mkdirSync(commandsDirectory, { mode: 0o700 });
|
|
fs.mkdirSync(ownerPepperKeyringDirectory, { mode: 0o700 });
|
|
const databasePath = path.join(deploymentRoot, 'qinglong3.sqlite');
|
|
const credentialFilePath = path.join(deploymentRoot, 'credential.json');
|
|
await migrateLocalSqlitePath({ databasePath, profile: 'edge' });
|
|
const pepperSummary = provisionLocalOwnerPepperKey({
|
|
keyringDirectory: ownerPepperKeyringDirectory,
|
|
pepperKeyId: PEPPER_KEY_ID,
|
|
randomBytes: () => Buffer.alloc(32, 121),
|
|
});
|
|
const now = Date.now();
|
|
const secretDigest = apiCredentialSecretDigest(
|
|
PEPPER,
|
|
CREDENTIAL_ID,
|
|
CREDENTIAL_SECRET,
|
|
);
|
|
const notBeforeAtMs = now - 1_000;
|
|
const expiresAtMs = now + 10 * 60 * 1_000;
|
|
const database = new DatabaseSync(databasePath);
|
|
try {
|
|
database
|
|
.prepare(
|
|
`INSERT INTO "QingLong3LocalOwnerPepperKeys" (
|
|
"pepper_key_id", "material_digest", "backup_digest", "state",
|
|
"version", "register_mutation_id", "activate_mutation_id",
|
|
"registered_at_ms", "activated_at_ms"
|
|
) VALUES (?, ?, ?, 'active', 2, ?, ?, ?, ?)`,
|
|
)
|
|
.run(
|
|
PEPPER_KEY_ID,
|
|
pepperSummary.digest,
|
|
'f'.repeat(64),
|
|
'81000000-0000-4000-8000-000000000001',
|
|
'81000000-0000-4000-8000-000000000002',
|
|
now - 2_000,
|
|
now - 1_500,
|
|
);
|
|
database
|
|
.prepare(
|
|
`INSERT INTO "QingLong3LocalOwnerPepperActivations" (
|
|
"generation", "mutation_id", "expected_generation",
|
|
"previous_pepper_key_id", "active_pepper_key_id",
|
|
"material_digest", "backup_digest", "activated_at_ms"
|
|
) VALUES (1, ?, 0, NULL, ?, ?, ?, ?)`,
|
|
)
|
|
.run(
|
|
'81000000-0000-4000-8000-000000000002',
|
|
PEPPER_KEY_ID,
|
|
pepperSummary.digest,
|
|
'f'.repeat(64),
|
|
now - 1_500,
|
|
);
|
|
database
|
|
.prepare(
|
|
`INSERT INTO "QingLong3IdentitySubjects" (
|
|
"subject_type", "subject_id", "status", "version",
|
|
"created_at_ms", "updated_at_ms"
|
|
) VALUES ('user', 'task-user', 'active', 1, ?, ?)`,
|
|
)
|
|
.run(now - 1_000, now - 1_000);
|
|
database
|
|
.prepare(
|
|
`INSERT INTO "QingLong3ApiCredentials" (
|
|
"credential_id", "version", "state", "subject_type",
|
|
"subject_id", "secret_digest", "created_at_ms",
|
|
"not_before_at_ms", "expires_at_ms"
|
|
) VALUES (?, 1, 'active', 'user', 'task-user', ?, ?, ?, ?)`,
|
|
)
|
|
.run(
|
|
CREDENTIAL_ID,
|
|
secretDigest,
|
|
now - 1_000,
|
|
notBeforeAtMs,
|
|
expiresAtMs,
|
|
);
|
|
database
|
|
.prepare(
|
|
`INSERT INTO "QingLong3ApiCredentialPepperBindings" (
|
|
"credential_id", "credential_version", "pepper_key_id"
|
|
) VALUES (?, 1, ?)`,
|
|
)
|
|
.run(CREDENTIAL_ID, PEPPER_KEY_ID);
|
|
database
|
|
.prepare(
|
|
`INSERT INTO "QingLong3ProjectRoleBindings" (
|
|
"project_id", "subject_type", "subject_id", "version", "state",
|
|
"role", "mutation_id", "changed_by_type", "changed_by_id",
|
|
"created_at_ms"
|
|
) VALUES (
|
|
'default', 'user', 'task-user', 1, 'active', ?,
|
|
'task-owner-binding', 'user', 'task-user', ?
|
|
)`,
|
|
)
|
|
.run(role, now - 500);
|
|
} finally {
|
|
database.close();
|
|
}
|
|
fs.chmodSync(databasePath, 0o600);
|
|
fs.writeFileSync(
|
|
credentialFilePath,
|
|
`${JSON.stringify({
|
|
schemaVersion: 1,
|
|
kind: 'qinglong3-local-identity-credential-presentation',
|
|
token: TOKEN,
|
|
})}\n`,
|
|
{ mode: 0o600 },
|
|
);
|
|
return {
|
|
deploymentRoot,
|
|
commandsDirectory,
|
|
databasePath,
|
|
now,
|
|
options: {
|
|
deploymentRoot,
|
|
databasePath,
|
|
profile: 'edge',
|
|
ownerPepperKeyringDirectory,
|
|
credentialFilePath,
|
|
},
|
|
};
|
|
}
|
|
|
|
function writeCommand(value, operation, request, name) {
|
|
const filePath = path.join(value.commandsDirectory, `${name}.json`);
|
|
fs.writeFileSync(
|
|
filePath,
|
|
`${JSON.stringify({
|
|
schemaVersion: 1,
|
|
operation,
|
|
options: value.options,
|
|
request,
|
|
})}\n`,
|
|
{ mode: 0o600 },
|
|
);
|
|
return filePath;
|
|
}
|
|
|
|
function putRequest(value, suffix, overrides = {}) {
|
|
return {
|
|
projectId: 'default',
|
|
taskId: 'task-product-entry',
|
|
expectedRevision: null,
|
|
mutationId: `82000000-0000-4000-8000-00000000000${suffix}`,
|
|
requestId: `task-put-${suffix}`,
|
|
failureAuditEventId: `83000000-0000-4000-8000-00000000000${suffix}`,
|
|
name: 'Product task',
|
|
kind: 'command',
|
|
spec: {
|
|
schema: 'qinglong/command@v1',
|
|
config: {
|
|
command: {
|
|
kind: 'argv',
|
|
file: '/bin/echo',
|
|
args: ['private-argument-not-output'],
|
|
},
|
|
},
|
|
},
|
|
labels: { owner: 'product' },
|
|
enabled: true,
|
|
occurredAtMs: value.now,
|
|
...overrides,
|
|
};
|
|
}
|
|
|
|
function auditRows(databasePath) {
|
|
const database = new DatabaseSync(databasePath, { readOnly: true });
|
|
try {
|
|
return database
|
|
.prepare(
|
|
`SELECT event_id AS "eventId", operation_id AS "operationId",
|
|
outcome, reasons_json AS "reasonsJson"
|
|
FROM "QingLong3SecurityAuditEvents" ORDER BY occurred_at_ms, event_id`,
|
|
)
|
|
.all();
|
|
} finally {
|
|
database.close();
|
|
}
|
|
}
|
|
|
|
test('creates, exactly replays, disables, inspects and lists a TaskDefinition', async (t) => {
|
|
const value = await fixture(t);
|
|
const createPath = writeCommand(
|
|
value,
|
|
'task.put',
|
|
putRequest(value, '1'),
|
|
'create',
|
|
);
|
|
const created = await runLocalTaskDefinitionCommandFile(createPath);
|
|
assert.equal(created.status, 'created');
|
|
assert.equal(created.task.revision, 1);
|
|
assert.equal(created.task.enabled, true);
|
|
assert.equal(created.task.schema, 'qinglong/command@v1');
|
|
assert.doesNotMatch(JSON.stringify(created), /private-argument-not-output/);
|
|
assert.equal(
|
|
(await runLocalTaskDefinitionCommandFile(createPath)).status,
|
|
'existing',
|
|
);
|
|
|
|
const updatePath = writeCommand(
|
|
value,
|
|
'task.put',
|
|
putRequest(value, '2', {
|
|
expectedRevision: 1,
|
|
mutationId: '82000000-0000-4000-8000-000000000002',
|
|
failureAuditEventId: '83000000-0000-4000-8000-000000000002',
|
|
requestId: 'task-put-2',
|
|
name: 'Product task disabled',
|
|
enabled: false,
|
|
occurredAtMs: value.now + 1,
|
|
}),
|
|
'disable',
|
|
);
|
|
const updated = await runLocalTaskDefinitionCommandFile(updatePath);
|
|
assert.equal(updated.status, 'updated');
|
|
assert.equal(updated.task.revision, 2);
|
|
assert.equal(updated.task.enabled, false);
|
|
|
|
const inspected = await runLocalTaskDefinitionCommandFile(
|
|
writeCommand(
|
|
value,
|
|
'task.inspect',
|
|
{
|
|
projectId: 'default',
|
|
taskId: 'task-product-entry',
|
|
requestId: 'task-inspect-1',
|
|
auditEventId: '84000000-0000-4000-8000-000000000001',
|
|
failureAuditEventId: '85000000-0000-4000-8000-000000000001',
|
|
},
|
|
'inspect',
|
|
),
|
|
);
|
|
assert.equal(inspected.found, true);
|
|
assert.equal(inspected.task.revision, 2);
|
|
assert.equal(Object.hasOwn(inspected.task, 'spec'), false);
|
|
|
|
const listed = await runLocalTaskDefinitionCommandFile(
|
|
writeCommand(
|
|
value,
|
|
'task.list',
|
|
{
|
|
projectId: 'default',
|
|
requestId: 'task-list-1',
|
|
auditEventId: '84000000-0000-4000-8000-000000000002',
|
|
failureAuditEventId: '85000000-0000-4000-8000-000000000002',
|
|
limit: 1,
|
|
},
|
|
'list',
|
|
),
|
|
);
|
|
assert.equal(listed.tasks.length, 1);
|
|
assert.equal(listed.tasks[0].taskId, 'task-product-entry');
|
|
assert.equal(listed.nextCursor, null);
|
|
|
|
const database = new DatabaseSync(value.databasePath, { readOnly: true });
|
|
try {
|
|
assert.equal(
|
|
database
|
|
.prepare(
|
|
'SELECT COUNT(*) AS count FROM "QingLong3TaskDefinitionRevisions"',
|
|
)
|
|
.get().count,
|
|
2,
|
|
);
|
|
assert.equal(
|
|
database
|
|
.prepare(
|
|
'SELECT COUNT(*) AS count FROM "QingLong3LocalTaskExecutionRevisions"',
|
|
)
|
|
.get().count,
|
|
1,
|
|
);
|
|
} finally {
|
|
database.close();
|
|
}
|
|
assert.deepEqual(
|
|
auditRows(value.databasePath).map((row) => [row.operationId, row.outcome]),
|
|
[
|
|
['task.create', 'allowed'],
|
|
['task.update', 'allowed'],
|
|
['task.read', 'allowed'],
|
|
['task.read', 'allowed'],
|
|
],
|
|
);
|
|
});
|
|
|
|
test('allows an operator to manage tasks but rejects a viewer atomically', async (t) => {
|
|
const operator = await fixture(t, { role: 'operator' });
|
|
assert.equal(
|
|
(
|
|
await runLocalTaskDefinitionCommandFile(
|
|
writeCommand(
|
|
operator,
|
|
'task.put',
|
|
putRequest(operator, '3'),
|
|
'operator-create',
|
|
),
|
|
)
|
|
).status,
|
|
'created',
|
|
);
|
|
|
|
const viewer = await fixture(t, { role: 'viewer' });
|
|
await assert.rejects(
|
|
runLocalTaskDefinitionCommandFile(
|
|
writeCommand(
|
|
viewer,
|
|
'task.put',
|
|
putRequest(viewer, '4'),
|
|
'viewer-create',
|
|
),
|
|
),
|
|
{ code: 'LOCAL_TASK_DEFINITION_ADMINISTRATION_FORBIDDEN' },
|
|
);
|
|
const database = new DatabaseSync(viewer.databasePath, { readOnly: true });
|
|
try {
|
|
assert.equal(
|
|
database
|
|
.prepare('SELECT COUNT(*) AS count FROM "QingLong3TaskDefinitions"')
|
|
.get().count,
|
|
0,
|
|
);
|
|
} finally {
|
|
database.close();
|
|
}
|
|
assert.deepEqual(
|
|
auditRows(viewer.databasePath).map((row) => [row.operationId, row.outcome]),
|
|
[['task.create', 'denied']],
|
|
);
|
|
});
|
|
|
|
test('rechecks the credential and Policy fence inside the Task transaction', async (t) => {
|
|
const value = await fixture(t);
|
|
const runner = createLocalTaskDefinitionCommandRunner({
|
|
openDatabase: openLocalSqliteTaskDefinitionAdministrationDatabase,
|
|
authenticate: require('@qinglong/local-owner-console/authenticated-command')
|
|
.establishAuthenticatedLocalCommand,
|
|
now: Date.now,
|
|
createService(projectPolicy, mutations, source, audit, options) {
|
|
const fencedMutations = {
|
|
async appendAuthorizedTaskDefinitionRevision(mutation) {
|
|
const competing = new DatabaseSync(value.databasePath);
|
|
try {
|
|
competing
|
|
.prepare(
|
|
`INSERT INTO "QingLong3ProjectRoleBindings" (
|
|
"project_id", "subject_type", "subject_id", "version",
|
|
"state", "role", "mutation_id", "changed_by_type",
|
|
"changed_by_id", "created_at_ms"
|
|
) VALUES (
|
|
'default', 'user', 'task-user', 2, 'revoked', NULL,
|
|
'task-race-revoke', 'user', 'task-user', ?
|
|
)`,
|
|
)
|
|
.run(value.now + 5);
|
|
} finally {
|
|
competing.close();
|
|
}
|
|
return mutations.appendAuthorizedTaskDefinitionRevision(mutation);
|
|
},
|
|
};
|
|
return createLocalTaskDefinitionAdministrationService(
|
|
projectPolicy,
|
|
fencedMutations,
|
|
source,
|
|
audit,
|
|
options,
|
|
);
|
|
},
|
|
});
|
|
const request = putRequest(value, '5');
|
|
await assert.rejects(
|
|
runner.run(writeCommand(value, 'task.put', request, 'fenced-create')),
|
|
{ code: 'TASK_DEFINITION_ADMINISTRATION_AUTHORIZATION_FENCE_CONFLICT' },
|
|
);
|
|
const database = new DatabaseSync(value.databasePath, { readOnly: true });
|
|
try {
|
|
assert.equal(
|
|
database
|
|
.prepare('SELECT COUNT(*) AS count FROM "QingLong3TaskDefinitions"')
|
|
.get().count,
|
|
0,
|
|
);
|
|
assert.equal(
|
|
database
|
|
.prepare(
|
|
'SELECT COUNT(*) AS count FROM "QingLong3SecurityAuditEvents" WHERE event_id = ?',
|
|
)
|
|
.get(request.mutationId).count,
|
|
0,
|
|
);
|
|
assert.equal(
|
|
database
|
|
.prepare(
|
|
'SELECT COUNT(*) AS count FROM "QingLong3SecurityAuditEvents" WHERE event_id = ?',
|
|
)
|
|
.get(request.failureAuditEventId).count,
|
|
1,
|
|
);
|
|
} finally {
|
|
database.close();
|
|
}
|
|
});
|
|
|
|
test('rejects mutation drift without adding a revision or changing its allowed audit', async (t) => {
|
|
const value = await fixture(t);
|
|
const original = putRequest(value, '6');
|
|
await runLocalTaskDefinitionCommandFile(
|
|
writeCommand(value, 'task.put', original, 'original'),
|
|
);
|
|
await assert.rejects(
|
|
runLocalTaskDefinitionCommandFile(
|
|
writeCommand(
|
|
value,
|
|
'task.put',
|
|
{
|
|
...original,
|
|
name: 'drifted replay',
|
|
failureAuditEventId: '83000000-0000-4000-8000-000000000007',
|
|
},
|
|
'drifted',
|
|
),
|
|
),
|
|
{ code: 'TASK_DEFINITION_CONFLICT' },
|
|
);
|
|
await assert.rejects(
|
|
runLocalTaskDefinitionCommandFile(
|
|
writeCommand(
|
|
value,
|
|
'task.put',
|
|
{
|
|
...original,
|
|
requestId: 'task-put-audit-drift',
|
|
failureAuditEventId: '83000000-0000-4000-8000-000000000009',
|
|
},
|
|
'audit-drifted',
|
|
),
|
|
),
|
|
{ code: 'TASK_DEFINITION_ADMINISTRATION_MUTATION_CONFLICT' },
|
|
);
|
|
const database = new DatabaseSync(value.databasePath, { readOnly: true });
|
|
try {
|
|
assert.equal(
|
|
database
|
|
.prepare(
|
|
'SELECT COUNT(*) AS count FROM "QingLong3TaskDefinitionRevisions"',
|
|
)
|
|
.get().count,
|
|
1,
|
|
);
|
|
} finally {
|
|
database.close();
|
|
}
|
|
assert.deepEqual(
|
|
auditRows(value.databasePath).map((row) => [row.eventId, row.outcome]),
|
|
[
|
|
[original.mutationId, 'allowed'],
|
|
['83000000-0000-4000-8000-000000000007', 'denied'],
|
|
['83000000-0000-4000-8000-000000000009', 'denied'],
|
|
],
|
|
);
|
|
});
|
|
|
|
test('requires a private command file and exposes one exact CLI surface', async (t) => {
|
|
const value = await fixture(t);
|
|
const commandPath = writeCommand(
|
|
value,
|
|
'task.put',
|
|
putRequest(value, '8'),
|
|
'broad',
|
|
);
|
|
fs.chmodSync(commandPath, 0o644);
|
|
await assert.rejects(runLocalTaskDefinitionCommandFile(commandPath), {
|
|
code: 'LOCAL_TASK_DEFINITION_COMMAND_CONFIGURATION_INVALID',
|
|
});
|
|
|
|
const cliPath = path.resolve(
|
|
__dirname,
|
|
'../dist/automation-management/taskDefinitionCli.js',
|
|
);
|
|
const help = spawnSync(process.execPath, [cliPath, '--help'], {
|
|
encoding: 'utf8',
|
|
});
|
|
assert.equal(help.status, 0);
|
|
assert.match(help.stdout, /^Usage: ql3-task run --command-file /);
|
|
const invalid = spawnSync(process.execPath, [cliPath, 'list'], {
|
|
encoding: 'utf8',
|
|
});
|
|
assert.equal(invalid.status, 64);
|
|
assert.equal(
|
|
JSON.parse(invalid.stderr).code,
|
|
'LOCAL_TASK_DEFINITION_CLI_USAGE_INVALID',
|
|
);
|
|
});
|