mirror of
https://github.com/whyour/qinglong.git
synced 2026-09-21 01:32:44 +08:00
826 lines
31 KiB
JavaScript
826 lines
31 KiB
JavaScript
'use strict';
|
|
|
|
const assert = require('node:assert/strict');
|
|
const { randomBytes, randomUUID } = require('node:crypto');
|
|
const { mkdirSync, rmSync, writeFileSync } = require('node:fs');
|
|
const { tmpdir } = require('node:os');
|
|
const { join } = require('node:path');
|
|
const { test } = require('node:test');
|
|
|
|
const {
|
|
createPostgresDatabaseOpener,
|
|
PostgresPluginPackageSecretBindingApprovalPlanReader,
|
|
PostgresPluginPackageSecretBindingRepository,
|
|
PostgresPluginPackageSecretBindingTransitionApprovalPlanReader,
|
|
} = require('@qinglong/cluster-postgres/package-executor');
|
|
const {
|
|
PostgresApprovedActionExecutionRepository,
|
|
} = require('@qinglong/cluster-postgres/approved-action-execution');
|
|
const {
|
|
runPostgresMigrations,
|
|
} = require('@qinglong/cluster-postgres/migration');
|
|
const {
|
|
PostgresApprovalRequestRepository,
|
|
} = require('@qinglong/cluster-postgres/approved-action');
|
|
const {
|
|
PostgresPluginPackageInstallRepository,
|
|
} = require('@qinglong/cluster-postgres/plugin-package-install');
|
|
const {
|
|
PLUGIN_PACKAGE_API_VERSION,
|
|
PLUGIN_PACKAGE_KIND,
|
|
planPluginPackageInstall,
|
|
} = require('@qinglong/runtime-core/plugin-package');
|
|
const {
|
|
pluginPackageInstallCommit,
|
|
pluginPackageActivationIntentDigest,
|
|
transitionPluginPackageInstall,
|
|
} = require('@qinglong/runtime-core/plugin-package-install');
|
|
const {
|
|
createPluginPackagePublisherProvenance,
|
|
} = require('@qinglong/runtime-core/plugin-package-publisher-provenance');
|
|
const { createSecretRef } = require('@qinglong/runtime-core/secret-reference');
|
|
const {
|
|
secretProjectionFileName,
|
|
} = require('@qinglong/runtime-core/secret-projection');
|
|
const {
|
|
createClusterPluginPackageManagementService,
|
|
} = require('@qinglong/cluster-admin/plugin-package-management');
|
|
const {
|
|
createClusterPluginPackageManagementTransport,
|
|
} = require('@qinglong/cluster-admin/plugin-package-management-transport');
|
|
const {
|
|
createClusterPluginPackageApprovedActionDispatcher,
|
|
} = require('@qinglong/cluster-admin/plugin-package-approved-action');
|
|
const {
|
|
createClusterPluginPackageSecretBindingManagementService,
|
|
} = require('@qinglong/cluster-admin/plugin-package-secret-binding-management');
|
|
const {
|
|
consumeClusterPluginPackageSecretBindingApprovals,
|
|
} = require('@qinglong/cluster-admin/plugin-package-secret-binding-approval-consumer');
|
|
const {
|
|
ProjectedPluginPackageSecretExistenceInspector,
|
|
} = require('@qinglong/cluster-admin/plugin-package-secret-existence-inspector');
|
|
const {
|
|
ClusterPluginPackageSecretBindingApprovedActionHandler,
|
|
} = require('@qinglong/cluster-admin/plugin-package-secret-binding-approved-action');
|
|
const {
|
|
createClusterPluginPackageSecretBindingTransitionManagementService,
|
|
} = require('@qinglong/cluster-admin/plugin-package-secret-binding-transition-management');
|
|
const {
|
|
consumeClusterPluginPackageSecretBindingTransitionApprovals,
|
|
} = require('@qinglong/cluster-admin/plugin-package-secret-binding-transition-approval-consumer');
|
|
|
|
const MIGRATION_URL =
|
|
process.env.QL3_TEST_POSTGRES_MIGRATION_URL ??
|
|
process.env.QL3_TEST_POSTGRES_URL;
|
|
const MANAGER_URL = process.env.QL3_TEST_POSTGRES_PACKAGE_MANAGER_URL;
|
|
const EXECUTOR_URL = process.env.QL3_TEST_POSTGRES_PACKAGE_EXECUTOR_URL;
|
|
|
|
function opener(role, connectionString, applicationName) {
|
|
return createPostgresDatabaseOpener({
|
|
role,
|
|
connection: { connectionString, tls: { mode: 'disable' } },
|
|
pool: { maxConnections: 2, applicationName },
|
|
onPoolError(error) {
|
|
throw error;
|
|
},
|
|
});
|
|
}
|
|
|
|
function principal(subject, authenticationId, now) {
|
|
return Object.freeze({
|
|
subject,
|
|
authenticationId,
|
|
authenticatedAtMs: now - 1,
|
|
expiresAtMs: now + 120_000,
|
|
assurance: 'multi_factor',
|
|
});
|
|
}
|
|
|
|
function audit(eventId, requestId, operationId, projectId, subject, now, fence) {
|
|
return Object.freeze({
|
|
eventId,
|
|
requestId,
|
|
operationId,
|
|
projectId,
|
|
subject,
|
|
authenticationId: 'cluster-secret-binding-integration',
|
|
outcome: 'allowed',
|
|
reasons: Object.freeze(['package_review']),
|
|
fence,
|
|
occurredAtMs: now,
|
|
});
|
|
}
|
|
|
|
if (!MIGRATION_URL || !MANAGER_URL || !EXECUTOR_URL) {
|
|
test('Cluster Secret binding PostgreSQL integration requires three role URLs', {
|
|
skip: true,
|
|
});
|
|
} else {
|
|
test('plans, approves, consumes and publishes one Secret binding through real PostgreSQL roles', async () => {
|
|
const suffix = randomBytes(4).toString('hex');
|
|
const projectId = `secret-binding-${suffix}`;
|
|
const packageName = `secret-binding-${suffix}`;
|
|
const requesterSubject = Object.freeze({ type: 'user', id: `owner-${suffix}` });
|
|
const reviewerSubject = Object.freeze({ type: 'user', id: `reviewer-${suffix}` });
|
|
const fence = Object.freeze({ projectVersion: 1, bindingVersion: 1 });
|
|
let now = Date.now();
|
|
const migration = await opener('migration', MIGRATION_URL, `ql3-secret-migrate-${suffix}`)();
|
|
const manager = await opener('package-manager', MANAGER_URL, `ql3-secret-manager-${suffix}`)();
|
|
const executor = await opener('package-executor', EXECUTOR_URL, `ql3-secret-executor-${suffix}`)();
|
|
const projectionRoot = join(tmpdir(), `ql3-secret-projection-${suffix}`);
|
|
mkdirSync(projectionRoot, { mode: 0o700 });
|
|
try {
|
|
await runPostgresMigrations({ pool: migration.pool });
|
|
await migration.pool.query(
|
|
`INSERT INTO "ql3"."projects" (
|
|
id, name, slug, status, version, created_at_ms, updated_at_ms
|
|
) VALUES ($1, $1, $1, 'active', 1, $2, $2)`,
|
|
[projectId, now],
|
|
);
|
|
await migration.pool.query(
|
|
`INSERT INTO "ql3"."project_role_bindings" (
|
|
project_id, subject_type, subject_id, version, state, role,
|
|
mutation_id, changed_by_type, changed_by_id, created_at_ms
|
|
) VALUES
|
|
($1, 'user', $2, 1, 'active', 'owner', $4, 'system', 'integration', $5),
|
|
($1, 'user', $3, 1, 'active', 'admin', $6, 'system', 'integration', $5)`,
|
|
[
|
|
projectId,
|
|
requesterSubject.id,
|
|
reviewerSubject.id,
|
|
`grant-owner-${suffix}`,
|
|
now,
|
|
`grant-reviewer-${suffix}`,
|
|
],
|
|
);
|
|
|
|
const manifest = Object.freeze({
|
|
apiVersion: PLUGIN_PACKAGE_API_VERSION,
|
|
kind: PLUGIN_PACKAGE_KIND,
|
|
metadata: {
|
|
name: packageName,
|
|
displayName: 'Secret binding PostgreSQL integration',
|
|
version: '1.0.0',
|
|
description: 'One bounded content-free Secret binding fixture',
|
|
license: 'Apache-2.0',
|
|
},
|
|
spec: {
|
|
compatibility: {
|
|
qinglong: '>=3.0.0-0 <4.0.0',
|
|
architectures: ['arm64'],
|
|
deploymentProfiles: ['cluster-control'],
|
|
},
|
|
runtimes: [],
|
|
resources: {
|
|
memory: { recommended: '16Mi' },
|
|
disk: { install: '4Mi', working: '8Mi' },
|
|
},
|
|
permissions: {
|
|
network: { allowedHosts: [] },
|
|
secrets: [{ name: 'TOKEN', required: false }],
|
|
tools: ['secret.use'],
|
|
},
|
|
contents: { tasks: [], workflows: [], prompts: [], tools: [] },
|
|
},
|
|
});
|
|
const environment = Object.freeze({
|
|
qinglongVersion: '3.0.0-alpha.0',
|
|
architecture: 'arm64',
|
|
deploymentProfile: 'cluster-control',
|
|
runtimes: [],
|
|
availableMemoryBytes: 128 * 1024 * 1024,
|
|
availableDiskBytes: 256 * 1024 * 1024,
|
|
});
|
|
const installPlan = planPluginPackageInstall(manifest, environment);
|
|
const actionInput = Object.freeze({
|
|
lockId: `lock-${suffix}`,
|
|
projectId,
|
|
manifest,
|
|
plan: installPlan,
|
|
environment,
|
|
source: {
|
|
kind: 'offline',
|
|
locator: `offline:sha256:${'a'.repeat(64)}`,
|
|
artifactDigest: 'a'.repeat(64),
|
|
artifactBytes: 2048,
|
|
contentDigest: 'b'.repeat(64),
|
|
},
|
|
architecture: 'arm64',
|
|
deploymentProfile: 'cluster-control',
|
|
targetGeneration: 1,
|
|
});
|
|
const installActionRef = `install:${packageName}:v1`;
|
|
const installApprovalId = `install-approval-${suffix}`;
|
|
const installManagement = createClusterPluginPackageManagementService({
|
|
pool: manager.pool,
|
|
now: () => now,
|
|
approvalLifetimeMs: 60_000,
|
|
});
|
|
const proposed = await installManagement.propose({
|
|
actionRef: installActionRef,
|
|
approvalRequestId: installApprovalId,
|
|
proposalAuditEventId: randomUUID(),
|
|
approvalAuditEventId: randomUUID(),
|
|
requestedAtMs: now,
|
|
actionInput,
|
|
principal: principal(requesterSubject, `install-owner-${suffix}`, now),
|
|
});
|
|
now += 10;
|
|
const installDecision = await installManagement.decide({
|
|
approvalRequestId: installApprovalId,
|
|
expectedVersion: proposed.approvalRequest.version,
|
|
decisionId: `install-decision-${suffix}`,
|
|
auditEventId: randomUUID(),
|
|
decision: 'approved',
|
|
reasonCode: 'reviewed',
|
|
decidedAtMs: now,
|
|
principal: principal(reviewerSubject, `install-reviewer-${suffix}`, now),
|
|
});
|
|
assert.equal(installDecision.status, 'decided');
|
|
now += 10;
|
|
const installConsumed = await new PostgresApprovalRequestRepository(
|
|
executor.pool,
|
|
).consume({
|
|
requestId: installApprovalId,
|
|
expectedVersion: installDecision.request.version,
|
|
consumptionId: `install-consume-${suffix}`,
|
|
dispatchId: `install-dispatch-${suffix}`,
|
|
action: installDecision.request.action,
|
|
requestedBy: requesterSubject,
|
|
consumedBy: { type: 'system', id: 'cluster_package_executor' },
|
|
consumedAtMs: now,
|
|
authorizationFence: fence,
|
|
audit: audit(
|
|
randomUUID(),
|
|
installApprovalId,
|
|
'approval.consume',
|
|
projectId,
|
|
{ type: 'system', id: 'cluster_package_executor' },
|
|
now,
|
|
fence,
|
|
),
|
|
});
|
|
assert.equal(installConsumed.status, 'consumed');
|
|
let id = 0;
|
|
now += 10;
|
|
const installDispatch = await createClusterPluginPackageApprovedActionDispatcher({
|
|
pool: executor.pool,
|
|
owner: `install-executor-${suffix}`,
|
|
clock: () => now,
|
|
createId: () => `install-executor-id-${suffix}-${++id}`,
|
|
secretExistenceInspector: { async assertExists() {} },
|
|
}).dispatchBatch({ limit: 4 });
|
|
assert.equal(installDispatch.succeeded, 1);
|
|
|
|
const installs = new PostgresPluginPackageInstallRepository(executor.pool);
|
|
const queued = await installs.find(projectId, packageName);
|
|
assert.ok(queued);
|
|
const lock = await installs.findLock(queued.lockDigest);
|
|
assert.ok(lock);
|
|
now += 10;
|
|
const staged = transitionPluginPackageInstall(lock, queued, {
|
|
type: 'stage_completed',
|
|
mutationId: `stage-${suffix}`,
|
|
occurredAtMs: now,
|
|
stageRef: `stage:${lock.lockDigest}`,
|
|
artifactDigest: lock.source.artifactDigest,
|
|
manifestDigest: lock.manifestDigest,
|
|
contentDigest: lock.source.contentDigest,
|
|
evidenceDigest: 'c'.repeat(64),
|
|
});
|
|
const provenance = createPluginPackagePublisherProvenance({
|
|
projectId,
|
|
packageName,
|
|
installationId: queued.installationId,
|
|
lockDigest: lock.lockDigest,
|
|
artifactDigest: staged.stageReceipt.artifactDigest,
|
|
manifestDigest: staged.stageReceipt.manifestDigest,
|
|
contentDigest: staged.stageReceipt.contentDigest,
|
|
stageEvidenceDigest: staged.stageReceipt.evidenceDigest,
|
|
signature: {
|
|
publisher: 'integration.qinglong.dev',
|
|
keyId: 'integration-key-1',
|
|
signatureDigest: 'd'.repeat(64),
|
|
keyNotBeforeMs: now - 1,
|
|
keyNotAfterMs: now + 60_000,
|
|
verifiedAtMs: now,
|
|
},
|
|
});
|
|
await executor.pool.query(
|
|
`INSERT INTO "ql3"."plugin_package_publisher_provenance" (
|
|
installation_id, project_id, package_name, lock_digest,
|
|
artifact_digest, manifest_digest, content_digest,
|
|
stage_evidence_digest, publisher, key_id, signature_digest,
|
|
key_not_before_ms, key_not_after_ms, verified_at_ms,
|
|
provenance_digest, provenance_json
|
|
) VALUES (
|
|
$1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11,
|
|
$12, $13, $14, $15, $16::jsonb
|
|
)`,
|
|
[
|
|
provenance.installationId,
|
|
provenance.projectId,
|
|
provenance.packageName,
|
|
provenance.lockDigest,
|
|
provenance.artifactDigest,
|
|
provenance.manifestDigest,
|
|
provenance.contentDigest,
|
|
provenance.stageEvidenceDigest,
|
|
provenance.publisher,
|
|
provenance.keyId,
|
|
provenance.signatureDigest,
|
|
provenance.keyNotBeforeMs,
|
|
provenance.keyNotAfterMs,
|
|
provenance.verifiedAtMs,
|
|
provenance.provenanceDigest,
|
|
JSON.stringify(provenance),
|
|
],
|
|
);
|
|
await installs.commit(pluginPackageInstallCommit(queued, staged));
|
|
now += 10;
|
|
const activating = transitionPluginPackageInstall(lock, staged, {
|
|
type: 'activation_started',
|
|
mutationId: `activate-${suffix}`,
|
|
occurredAtMs: now,
|
|
});
|
|
await installs.commit(pluginPackageInstallCommit(staged, activating));
|
|
now += 10;
|
|
const active = transitionPluginPackageInstall(lock, activating, {
|
|
type: 'activation_committed',
|
|
mutationId: `commit-${suffix}`,
|
|
occurredAtMs: now,
|
|
activationRef: `active:${lock.lockDigest}`,
|
|
intentDigest: pluginPackageActivationIntentDigest(lock, activating),
|
|
generation: 1,
|
|
contentDigest: lock.source.contentDigest,
|
|
});
|
|
await installs.commit(pluginPackageInstallCommit(activating, active));
|
|
|
|
const secretRef = createSecretRef({
|
|
projectId,
|
|
name: 'runtime-token',
|
|
version: 1,
|
|
});
|
|
writeFileSync(join(projectionRoot, secretProjectionFileName(secretRef)), '', {
|
|
mode: 0o440,
|
|
});
|
|
const secretActionRef = `secret-binding:${packageName}:v1`;
|
|
const secretApprovalId = `secret-approval-${suffix}`;
|
|
const secretManagement = createClusterPluginPackageSecretBindingManagementService({
|
|
pool: manager.pool,
|
|
now: () => now,
|
|
planLifetimeMs: 60_000,
|
|
approvalLifetimeMs: 60_000,
|
|
});
|
|
const secretTransport = createClusterPluginPackageManagementTransport({
|
|
service: installManagement,
|
|
secretBinding: secretManagement,
|
|
now: () => now,
|
|
});
|
|
const requesterAuthentication = {
|
|
async authenticate() {
|
|
return principal(requesterSubject, `secret-owner-${suffix}`, now);
|
|
},
|
|
};
|
|
const plannedPublic = await secretTransport.execute(
|
|
{
|
|
schemaVersion: 1,
|
|
operation: 'plugin-package.secret-binding.plan',
|
|
request: {
|
|
actionRef: secretActionRef,
|
|
projectId,
|
|
packageName,
|
|
assignments: [{ name: 'TOKEN', secretRef }],
|
|
},
|
|
},
|
|
requesterAuthentication,
|
|
);
|
|
assert.equal(plannedPublic.status, 'created');
|
|
assert.equal(plannedPublic.plan.actionRef, secretActionRef);
|
|
assert.deepEqual(plannedPublic.plan.entries, [
|
|
{ name: 'TOKEN', required: false, secretRef },
|
|
]);
|
|
assert.equal(Object.hasOwn(plannedPublic.plan, 'authenticationId'), false);
|
|
now = Math.max(now, plannedPublic.plan.plannedAtMs);
|
|
const replay = await secretTransport.execute(
|
|
{
|
|
schemaVersion: 1,
|
|
operation: 'plugin-package.secret-binding.plan',
|
|
request: {
|
|
actionRef: secretActionRef,
|
|
projectId,
|
|
packageName,
|
|
assignments: [{ name: 'TOKEN', secretRef }],
|
|
},
|
|
},
|
|
requesterAuthentication,
|
|
);
|
|
assert.equal(replay.status, 'existing');
|
|
now += 10;
|
|
const secretProposed = await secretTransport.execute(
|
|
{
|
|
schemaVersion: 1,
|
|
operation: 'plugin-package.secret-binding.propose',
|
|
request: {
|
|
actionRef: secretActionRef,
|
|
approvalRequestId: secretApprovalId,
|
|
approvalAuditEventId: randomUUID(),
|
|
},
|
|
},
|
|
requesterAuthentication,
|
|
);
|
|
now += 10;
|
|
const secretDecision = await secretTransport.execute(
|
|
{
|
|
schemaVersion: 1,
|
|
operation: 'plugin-package.secret-binding.decide',
|
|
request: {
|
|
actionRef: secretActionRef,
|
|
approvalRequestId: secretApprovalId,
|
|
expectedVersion: secretProposed.approval.version,
|
|
decisionId: `secret-decision-${suffix}`,
|
|
auditEventId: randomUUID(),
|
|
decision: 'approved',
|
|
reasonCode: 'reviewed',
|
|
},
|
|
},
|
|
{
|
|
async authenticate() {
|
|
return principal(
|
|
reviewerSubject,
|
|
`secret-reviewer-${suffix}`,
|
|
now,
|
|
);
|
|
},
|
|
},
|
|
);
|
|
assert.equal(secretDecision.status, 'decided');
|
|
const inspected = await secretTransport.execute(
|
|
{
|
|
schemaVersion: 1,
|
|
operation: 'plugin-package.secret-binding.inspect',
|
|
request: {
|
|
actionRef: secretActionRef,
|
|
approvalRequestId: secretApprovalId,
|
|
inspectionId: `secret-inspection-${suffix}`,
|
|
},
|
|
},
|
|
requesterAuthentication,
|
|
);
|
|
assert.deepEqual(inspected.plan, plannedPublic.plan);
|
|
assert.equal(inspected.approval?.state, 'approved');
|
|
assert.equal(inspected.approval?.decision, 'approved');
|
|
assert.equal(inspected.stale, false);
|
|
now += 10;
|
|
assert.deepEqual(
|
|
await consumeClusterPluginPackageSecretBindingApprovals({
|
|
pool: executor.pool,
|
|
now: () => now,
|
|
limit: 4,
|
|
}),
|
|
{ scanned: 1, consumed: 1, existing: 0, expired: 0, blocked: 0 },
|
|
);
|
|
const inspector = new ProjectedPluginPackageSecretExistenceInspector({
|
|
rootDirectory: projectionRoot,
|
|
});
|
|
await inspector.assertExists([secretRef]);
|
|
const consumedSecretApproval =
|
|
await new PostgresApprovalRequestRepository(executor.pool).findById(
|
|
secretApprovalId,
|
|
);
|
|
assert.ok(consumedSecretApproval?.dispatchId);
|
|
const pendingSecretExecution =
|
|
await new PostgresApprovedActionExecutionRepository(
|
|
executor.pool,
|
|
).findExecutionByDispatchId(consumedSecretApproval.dispatchId);
|
|
assert.ok(pendingSecretExecution);
|
|
assert.deepEqual(
|
|
await new ClusterPluginPackageSecretBindingApprovedActionHandler(
|
|
new PostgresPluginPackageSecretBindingApprovalPlanReader(
|
|
executor.pool,
|
|
),
|
|
new PostgresPluginPackageSecretBindingRepository(executor.pool),
|
|
inspector,
|
|
).inspect(pendingSecretExecution.dispatch),
|
|
{
|
|
status: 'ready',
|
|
actionDigest: plannedPublic.plan.approvalPlanDigest,
|
|
},
|
|
);
|
|
id = 0;
|
|
now += 10;
|
|
const secretDispatcher = createClusterPluginPackageApprovedActionDispatcher({
|
|
pool: executor.pool,
|
|
owner: `secret-executor-${suffix}`,
|
|
clock: () => now,
|
|
createId: () => `secret-executor-id-${suffix}-${++id}`,
|
|
secretExistenceInspector: inspector,
|
|
});
|
|
const secretDispatch = await secretDispatcher.dispatchBatch({ limit: 4 });
|
|
assert.equal(secretDispatch.succeeded, 1);
|
|
const bindings = new PostgresPluginPackageSecretBindingRepository(executor.pool);
|
|
const binding = await bindings.find(
|
|
plannedPublic.plan.generationDigest,
|
|
);
|
|
assert.ok(binding);
|
|
assert.equal(binding.authority.kind, 'approved-action-execution');
|
|
assert.equal(
|
|
binding.authority.evidenceDigest,
|
|
plannedPublic.plan.approvalPlanDigest,
|
|
);
|
|
assert.deepEqual(binding.entries, plannedPublic.plan.entries);
|
|
assert.doesNotMatch(JSON.stringify(binding), /secret-value/);
|
|
assert.equal((await secretDispatcher.dispatchBatch({ limit: 4 })).scanned, 0);
|
|
|
|
const manifestV2 = Object.freeze({
|
|
...manifest,
|
|
metadata: Object.freeze({ ...manifest.metadata, version: '2.0.0' }),
|
|
});
|
|
const actionInputV2 = Object.freeze({
|
|
lockId: `lock-v2-${suffix}`,
|
|
projectId,
|
|
manifest: manifestV2,
|
|
previousManifest: manifest,
|
|
plan: planPluginPackageInstall(manifestV2, environment, manifest),
|
|
environment,
|
|
source: {
|
|
kind: 'offline',
|
|
locator: `offline:sha256:${'e'.repeat(64)}`,
|
|
artifactDigest: 'e'.repeat(64),
|
|
artifactBytes: 2048,
|
|
contentDigest: 'f'.repeat(64),
|
|
},
|
|
architecture: 'arm64',
|
|
deploymentProfile: 'cluster-control',
|
|
targetGeneration: 2,
|
|
previousLockDigest: lock.lockDigest,
|
|
});
|
|
const upgradeApprovalId = `upgrade-approval-${suffix}`;
|
|
now += 10;
|
|
const upgradeProposed = await installManagement.propose({
|
|
actionRef: `install:${packageName}:v2`,
|
|
approvalRequestId: upgradeApprovalId,
|
|
proposalAuditEventId: randomUUID(),
|
|
approvalAuditEventId: randomUUID(),
|
|
requestedAtMs: now,
|
|
actionInput: actionInputV2,
|
|
principal: principal(requesterSubject, `upgrade-owner-${suffix}`, now),
|
|
});
|
|
now += 10;
|
|
const upgradeDecision = await installManagement.decide({
|
|
approvalRequestId: upgradeApprovalId,
|
|
expectedVersion: upgradeProposed.approvalRequest.version,
|
|
decisionId: `upgrade-decision-${suffix}`,
|
|
auditEventId: randomUUID(),
|
|
decision: 'approved',
|
|
reasonCode: 'reviewed',
|
|
decidedAtMs: now,
|
|
principal: principal(reviewerSubject, `upgrade-reviewer-${suffix}`, now),
|
|
});
|
|
now += 10;
|
|
const upgradeConsumed = await new PostgresApprovalRequestRepository(
|
|
executor.pool,
|
|
).consume({
|
|
requestId: upgradeApprovalId,
|
|
expectedVersion: upgradeDecision.request.version,
|
|
consumptionId: `upgrade-consume-${suffix}`,
|
|
dispatchId: `upgrade-dispatch-${suffix}`,
|
|
action: upgradeDecision.request.action,
|
|
requestedBy: requesterSubject,
|
|
consumedBy: { type: 'system', id: 'cluster_package_executor' },
|
|
consumedAtMs: now,
|
|
authorizationFence: fence,
|
|
audit: audit(
|
|
randomUUID(),
|
|
upgradeApprovalId,
|
|
'approval.consume',
|
|
projectId,
|
|
{ type: 'system', id: 'cluster_package_executor' },
|
|
now,
|
|
fence,
|
|
),
|
|
});
|
|
assert.equal(upgradeConsumed.status, 'consumed');
|
|
id = 0;
|
|
now += 10;
|
|
const upgradeDispatch =
|
|
await createClusterPluginPackageApprovedActionDispatcher({
|
|
pool: executor.pool,
|
|
owner: `upgrade-executor-${suffix}`,
|
|
clock: () => now,
|
|
createId: () => `upgrade-executor-id-${suffix}-${++id}`,
|
|
secretExistenceInspector: inspector,
|
|
}).dispatchBatch({ limit: 4 });
|
|
assert.equal(upgradeDispatch.succeeded, 1);
|
|
const queuedV2 = await installs.find(projectId, packageName);
|
|
assert.ok(queuedV2);
|
|
assert.equal(queuedV2.targetGeneration, 2);
|
|
const lockV2 = await installs.findLock(queuedV2.lockDigest);
|
|
assert.ok(lockV2);
|
|
now += 10;
|
|
const stagedV2 = transitionPluginPackageInstall(lockV2, queuedV2, {
|
|
type: 'stage_completed',
|
|
mutationId: `stage-v2-${suffix}`,
|
|
occurredAtMs: now,
|
|
stageRef: `stage:${lockV2.lockDigest}`,
|
|
artifactDigest: lockV2.source.artifactDigest,
|
|
manifestDigest: lockV2.manifestDigest,
|
|
contentDigest: lockV2.source.contentDigest,
|
|
evidenceDigest: '8'.repeat(64),
|
|
});
|
|
const provenanceV2 = createPluginPackagePublisherProvenance({
|
|
projectId,
|
|
packageName,
|
|
installationId: queuedV2.installationId,
|
|
lockDigest: lockV2.lockDigest,
|
|
artifactDigest: stagedV2.stageReceipt.artifactDigest,
|
|
manifestDigest: stagedV2.stageReceipt.manifestDigest,
|
|
contentDigest: stagedV2.stageReceipt.contentDigest,
|
|
stageEvidenceDigest: stagedV2.stageReceipt.evidenceDigest,
|
|
signature: {
|
|
publisher: 'integration.qinglong.dev',
|
|
keyId: 'integration-key-1',
|
|
signatureDigest: '9'.repeat(64),
|
|
keyNotBeforeMs: now - 1,
|
|
keyNotAfterMs: now + 60_000,
|
|
verifiedAtMs: now,
|
|
},
|
|
});
|
|
await executor.pool.query(
|
|
`INSERT INTO "ql3"."plugin_package_publisher_provenance" (
|
|
installation_id, project_id, package_name, lock_digest,
|
|
artifact_digest, manifest_digest, content_digest,
|
|
stage_evidence_digest, publisher, key_id, signature_digest,
|
|
key_not_before_ms, key_not_after_ms, verified_at_ms,
|
|
provenance_digest, provenance_json
|
|
) VALUES (
|
|
$1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11,
|
|
$12, $13, $14, $15, $16::jsonb
|
|
)`,
|
|
[
|
|
provenanceV2.installationId,
|
|
provenanceV2.projectId,
|
|
provenanceV2.packageName,
|
|
provenanceV2.lockDigest,
|
|
provenanceV2.artifactDigest,
|
|
provenanceV2.manifestDigest,
|
|
provenanceV2.contentDigest,
|
|
provenanceV2.stageEvidenceDigest,
|
|
provenanceV2.publisher,
|
|
provenanceV2.keyId,
|
|
provenanceV2.signatureDigest,
|
|
provenanceV2.keyNotBeforeMs,
|
|
provenanceV2.keyNotAfterMs,
|
|
provenanceV2.verifiedAtMs,
|
|
provenanceV2.provenanceDigest,
|
|
JSON.stringify(provenanceV2),
|
|
],
|
|
);
|
|
await installs.commit(pluginPackageInstallCommit(queuedV2, stagedV2));
|
|
|
|
const secretRefV2 = createSecretRef({
|
|
projectId,
|
|
name: 'runtime-token',
|
|
version: 2,
|
|
});
|
|
writeFileSync(
|
|
join(projectionRoot, secretProjectionFileName(secretRefV2)),
|
|
'',
|
|
{ mode: 0o440 },
|
|
);
|
|
const transitionActionRef = `secret-transition:${packageName}:v2`;
|
|
const transitionApprovalId = `secret-transition-approval-${suffix}`;
|
|
const transitionManagement =
|
|
createClusterPluginPackageSecretBindingTransitionManagementService({
|
|
pool: manager.pool,
|
|
now: () => now,
|
|
planLifetimeMs: 60_000,
|
|
approvalLifetimeMs: 60_000,
|
|
});
|
|
const transitionTransport = createClusterPluginPackageManagementTransport({
|
|
service: installManagement,
|
|
secretBindingTransition: transitionManagement,
|
|
now: () => now,
|
|
});
|
|
const transitionPlan = await transitionTransport.execute({
|
|
schemaVersion: 1,
|
|
operation: 'plugin-package.secret-binding.transition.plan',
|
|
request: {
|
|
actionRef: transitionActionRef,
|
|
projectId,
|
|
packageName,
|
|
assignments: [{ name: 'TOKEN', secretRef: secretRefV2 }],
|
|
},
|
|
}, requesterAuthentication);
|
|
assert.equal(transitionPlan.status, 'created');
|
|
assert.equal(transitionPlan.plan.kind, 'rotate');
|
|
assert.equal(transitionPlan.plan.previousGeneration, 1);
|
|
assert.equal(transitionPlan.plan.nextGeneration, 2);
|
|
assert.equal(
|
|
transitionPlan.plan.previousActiveLockDigest,
|
|
lock.lockDigest,
|
|
);
|
|
now = Math.max(now, transitionPlan.plan.plannedAtMs) + 10;
|
|
const transitionProposed = await transitionTransport.execute({
|
|
schemaVersion: 1,
|
|
operation: 'plugin-package.secret-binding.transition.propose',
|
|
request: {
|
|
actionRef: transitionActionRef,
|
|
approvalRequestId: transitionApprovalId,
|
|
approvalAuditEventId: randomUUID(),
|
|
},
|
|
}, requesterAuthentication);
|
|
now += 10;
|
|
const transitionDecision = await transitionTransport.execute({
|
|
schemaVersion: 1,
|
|
operation: 'plugin-package.secret-binding.transition.decide',
|
|
request: {
|
|
actionRef: transitionActionRef,
|
|
approvalRequestId: transitionApprovalId,
|
|
expectedVersion: transitionProposed.approval.version,
|
|
decisionId: `secret-transition-decision-${suffix}`,
|
|
auditEventId: randomUUID(),
|
|
decision: 'approved',
|
|
reasonCode: 'reviewed',
|
|
},
|
|
}, {
|
|
async authenticate() {
|
|
return principal(
|
|
reviewerSubject,
|
|
`secret-transition-reviewer-${suffix}`,
|
|
now,
|
|
);
|
|
},
|
|
});
|
|
assert.equal(transitionDecision.status, 'decided');
|
|
now += 10;
|
|
assert.deepEqual(
|
|
await consumeClusterPluginPackageSecretBindingTransitionApprovals({
|
|
pool: executor.pool,
|
|
now: () => now,
|
|
limit: 4,
|
|
}),
|
|
{ scanned: 1, consumed: 1, existing: 0, expired: 0, blocked: 0 },
|
|
);
|
|
const transitionApproval =
|
|
await new PostgresApprovalRequestRepository(executor.pool).findById(
|
|
transitionApprovalId,
|
|
);
|
|
assert.ok(transitionApproval?.dispatchId);
|
|
const transitionExecution =
|
|
await new PostgresApprovedActionExecutionRepository(
|
|
executor.pool,
|
|
).findExecutionByDispatchId(transitionApproval.dispatchId);
|
|
assert.ok(transitionExecution);
|
|
const storedTransitionPlan =
|
|
await new PostgresPluginPackageSecretBindingTransitionApprovalPlanReader(
|
|
executor.pool,
|
|
).findByActionRef(transitionActionRef);
|
|
assert.equal(
|
|
storedTransitionPlan?.approvalPlanDigest,
|
|
transitionPlan.plan.approvalPlanDigest,
|
|
);
|
|
id = 0;
|
|
now += 10;
|
|
const transitionDispatch =
|
|
await createClusterPluginPackageApprovedActionDispatcher({
|
|
pool: executor.pool,
|
|
owner: `transition-executor-${suffix}`,
|
|
clock: () => now,
|
|
createId: () => `transition-executor-id-${suffix}-${++id}`,
|
|
secretExistenceInspector: inspector,
|
|
}).dispatchBatch({ limit: 4 });
|
|
assert.equal(transitionDispatch.succeeded, 1);
|
|
const transitionReceipt = await executor.pool.query(
|
|
`SELECT receipt_json AS "receiptJson"
|
|
FROM "ql3"."plugin_package_secret_binding_transition_receipts"
|
|
WHERE generation_digest = $1`,
|
|
[transitionPlan.plan.nextGenerationDigest],
|
|
);
|
|
assert.equal(transitionReceipt.rows.length, 1);
|
|
assert.equal(
|
|
transitionReceipt.rows[0].receiptJson.authority.evidenceDigest,
|
|
transitionPlan.plan.approvalPlanDigest,
|
|
);
|
|
const bindingV2 = await bindings.find(
|
|
transitionPlan.plan.nextGenerationDigest,
|
|
);
|
|
assert.ok(bindingV2);
|
|
assert.deepEqual(bindingV2.entries, [
|
|
{ name: 'TOKEN', required: false, secretRef: secretRefV2 },
|
|
]);
|
|
await assert.rejects(
|
|
manager.pool.query(
|
|
`SELECT * FROM "ql3"."plugin_package_secret_bindings" WHERE generation_digest = $1`,
|
|
[binding.target.generationDigest],
|
|
),
|
|
(error) => error?.code === '42501',
|
|
);
|
|
} finally {
|
|
await Promise.all([migration.close(), manager.close(), executor.close()]);
|
|
rmSync(projectionRoot, { recursive: true, force: true });
|
|
}
|
|
});
|
|
}
|