mirror of
https://github.com/whyour/qinglong.git
synced 2026-09-21 01:32:44 +08:00
105 lines
3.4 KiB
JavaScript
105 lines
3.4 KiB
JavaScript
const assert = require('node:assert/strict');
|
|
const { test } = require('node:test');
|
|
const {
|
|
WorkerCredentialUnavailableError,
|
|
} = require('@qinglong/runtime-core/worker-credential');
|
|
const {
|
|
workerCredentialSecretDigest,
|
|
} = require('@qinglong/runtime-core/worker-credential-token');
|
|
const {
|
|
createWorkerCredentialAuthenticator,
|
|
} = require('@qinglong/cluster-control/worker-ingress');
|
|
|
|
const NOW = 10_000;
|
|
const PEPPER = Buffer.alloc(32, 1).toString('base64url');
|
|
const SECRET = Buffer.alloc(32, 2).toString('base64url');
|
|
const CREDENTIAL_ID = 'worker_primary';
|
|
|
|
function metadata(authorization = `Worker ql3w_${CREDENTIAL_ID}_${SECRET}`) {
|
|
return {
|
|
requestId: 'request-1',
|
|
method: 'POST',
|
|
path: '/api/v3/worker-ingress/workers/edge-1/sessions/018f5c64-9b9d-7f1a-8c2d-1234567890ac/heartbeat',
|
|
query: Object.freeze({}),
|
|
headers: Object.freeze({ authorization }),
|
|
signal: new AbortController().signal,
|
|
};
|
|
}
|
|
|
|
function credential(overrides = {}) {
|
|
return {
|
|
credentialId: CREDENTIAL_ID,
|
|
version: 2,
|
|
state: 'active',
|
|
workerId: 'edge-1',
|
|
secretDigest: workerCredentialSecretDigest(PEPPER, CREDENTIAL_ID, SECRET),
|
|
createdAtMs: 1,
|
|
notBeforeAtMs: 1,
|
|
expiresAtMs: 100_000,
|
|
...overrides,
|
|
};
|
|
}
|
|
|
|
function authenticator(value = credential(), overrides = {}) {
|
|
return createWorkerCredentialAuthenticator(
|
|
{ async resolve(id) { assert.equal(id, CREDENTIAL_ID); return value; } },
|
|
PEPPER,
|
|
{ now: () => NOW, ...overrides },
|
|
);
|
|
}
|
|
|
|
test('authenticates a ql3w credential as its bound short-lived Worker', async () => {
|
|
assert.deepEqual(await authenticator().authenticate(metadata()), {
|
|
workerId: 'edge-1',
|
|
credentialId: CREDENTIAL_ID,
|
|
credentialVersion: 2,
|
|
authenticationId: `worker_credential:${CREDENTIAL_ID}:2`,
|
|
authenticatedAtMs: NOW,
|
|
expiresAtMs: 70_000,
|
|
});
|
|
});
|
|
|
|
test('rejects malformed, mismatched, inactive and expired Worker credentials', async () => {
|
|
let calls = 0;
|
|
const strict = createWorkerCredentialAuthenticator(
|
|
{ async resolve() { calls += 1; return credential(); } },
|
|
PEPPER,
|
|
{ now: () => NOW },
|
|
);
|
|
for (const authorization of [
|
|
undefined,
|
|
'Bearer ql3w_worker_primary_invalid',
|
|
`Worker ql3w_${CREDENTIAL_ID}_${Buffer.alloc(32, 3).toString('base64url')}`,
|
|
]) {
|
|
const request = metadata();
|
|
request.headers = Object.freeze(authorization ? { authorization } : {});
|
|
assert.equal(await strict.authenticate(request), null);
|
|
}
|
|
assert.equal(calls, 1);
|
|
for (const value of [
|
|
null,
|
|
credential({ state: 'revoked' }),
|
|
credential({ notBeforeAtMs: NOW + 1 }),
|
|
credential({ expiresAtMs: NOW }),
|
|
]) assert.equal(await authenticator(value).authenticate(metadata()), null);
|
|
});
|
|
|
|
test('maps storage, corrupt records and cancellation to unavailable', async () => {
|
|
const unavailable = createWorkerCredentialAuthenticator(
|
|
{ async resolve() { throw new Error('database unavailable'); } },
|
|
PEPPER,
|
|
{ now: () => NOW },
|
|
);
|
|
await assert.rejects(unavailable.authenticate(metadata()), WorkerCredentialUnavailableError);
|
|
await assert.rejects(
|
|
authenticator(credential({ secretDigest: 'corrupt' })).authenticate(metadata()),
|
|
WorkerCredentialUnavailableError,
|
|
);
|
|
const controller = new AbortController();
|
|
controller.abort();
|
|
await assert.rejects(
|
|
authenticator().authenticate({ ...metadata(), signal: controller.signal }),
|
|
WorkerCredentialUnavailableError,
|
|
);
|
|
});
|