mirror of
https://github.com/whyour/qinglong.git
synced 2026-09-21 01:32:44 +08:00
109 lines
6.6 KiB
TypeScript
109 lines
6.6 KiB
TypeScript
import { definePostgresSqlMigration } from './sqlMigration';
|
|
|
|
const CAPABILITIES_V40 =
|
|
'{"api_credential":1,"api_credential_admin":1,"api_credential_pepper_binding":1,"approved_action":1,"approved_action_execution":1,"cluster_execution_revision":1,"cluster_recovery":1,"cluster_recovery_claim":1,"cluster_scheduler_admission":1,"database_role_grants":1,"identity_admin":1,"plugin_package_admission":1,"plugin_package_authority_split":1,"plugin_package_identity_keyset_ledger":1,"plugin_package_install":1,"plugin_package_lifecycle":1,"plugin_package_management_quota":1,"plugin_package_materialized_revision":1,"plugin_package_proposal":1,"plugin_package_publisher_provenance":1,"plugin_package_publisher_trust_authority":1,"plugin_package_publisher_trust_transition":1,"plugin_package_quarantine":1,"plugin_package_task_reconciliation":1,"project_policy":1,"project_tool_definition_snapshot":1,"run_core":1,"run_dispatch_lease":1,"run_retry_policy":1,"security_audit":1,"security_audit_query":1,"step_run":1,"task_definition":1,"tool_execution_artifact_binding":1,"tool_execution_completion":1,"tool_execution_evidence":1,"tool_execution_failure_completion":1,"tool_execution_start_barrier":1,"tool_invocation_artifact":1,"tool_result_key_catalog":1,"tool_result_rekey":1,"trigger_definition":1,"worker_attestation":1,"worker_credential":1,"worker_credential_delivery":1,"worker_credential_stage_discard":1,"worker_session":1}';
|
|
const CAPABILITIES_V41 =
|
|
'{"api_credential":1,"api_credential_admin":1,"api_credential_pepper_binding":1,"approved_action":1,"approved_action_execution":1,"cluster_execution_revision":1,"cluster_recovery":1,"cluster_recovery_claim":1,"cluster_scheduler_admission":1,"database_role_grants":1,"identity_admin":1,"plugin_package_admission":1,"plugin_package_authority_split":1,"plugin_package_identity_keyset_ledger":1,"plugin_package_install":1,"plugin_package_lifecycle":1,"plugin_package_lifecycle_plan":1,"plugin_package_management_quota":1,"plugin_package_materialized_revision":1,"plugin_package_proposal":1,"plugin_package_publisher_provenance":1,"plugin_package_publisher_trust_authority":1,"plugin_package_publisher_trust_transition":1,"plugin_package_quarantine":1,"plugin_package_task_reconciliation":1,"project_policy":1,"project_tool_definition_snapshot":1,"run_core":1,"run_dispatch_lease":1,"run_retry_policy":1,"security_audit":1,"security_audit_query":1,"step_run":1,"task_definition":1,"tool_execution_artifact_binding":1,"tool_execution_completion":1,"tool_execution_evidence":1,"tool_execution_failure_completion":1,"tool_execution_start_barrier":1,"tool_invocation_artifact":1,"tool_result_key_catalog":1,"tool_result_rekey":1,"trigger_definition":1,"worker_attestation":1,"worker_credential":1,"worker_credential_delivery":1,"worker_credential_stage_discard":1,"worker_session":1}';
|
|
|
|
export const pg0042PluginPackageLifecyclePlansMigration =
|
|
definePostgresSqlMigration({
|
|
id: 'pg-0042-plugin-package-lifecycle-plans',
|
|
statements: [
|
|
`
|
|
CREATE TABLE "ql3"."plugin_package_lifecycle_plans" (
|
|
action_ref varchar(255) PRIMARY KEY,
|
|
plan_digest char(64) NOT NULL,
|
|
action varchar(16) NOT NULL,
|
|
project_id varchar(128) NOT NULL,
|
|
package_name varchar(63) NOT NULL,
|
|
installation_id varchar(128) NOT NULL,
|
|
lock_digest char(64) NOT NULL,
|
|
impact_digest char(64) NOT NULL,
|
|
requested_by_type varchar(16) NOT NULL,
|
|
requested_by_id varchar(255) NOT NULL,
|
|
planned_at_ms bigint NOT NULL,
|
|
expires_at_ms bigint NOT NULL,
|
|
plan_json jsonb NOT NULL,
|
|
CONSTRAINT ql3_plugin_package_lifecycle_plan_install_fk
|
|
FOREIGN KEY (installation_id)
|
|
REFERENCES "ql3"."plugin_package_installs" (installation_id)
|
|
ON DELETE RESTRICT,
|
|
CONSTRAINT ql3_plugin_package_lifecycle_plan_identity_check CHECK (
|
|
action_ref ~ '^[A-Za-z0-9][A-Za-z0-9._:/-]{0,254}$'
|
|
AND action IN ('disable', 'enable', 'uninstall')
|
|
AND package_name ~ '^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$'
|
|
AND requested_by_type = 'user'
|
|
AND char_length(requested_by_id) BETWEEN 1 AND 255
|
|
AND requested_by_id !~ '[[:cntrl:]]'
|
|
),
|
|
CONSTRAINT ql3_plugin_package_lifecycle_plan_digest_check CHECK (
|
|
plan_digest ~ '^[0-9a-f]{64}$'
|
|
AND lock_digest ~ '^[0-9a-f]{64}$'
|
|
AND impact_digest ~ '^[0-9a-f]{64}$'
|
|
),
|
|
CONSTRAINT ql3_plugin_package_lifecycle_plan_time_check CHECK (
|
|
planned_at_ms >= 0
|
|
AND expires_at_ms > planned_at_ms
|
|
AND expires_at_ms - planned_at_ms <= 900000
|
|
),
|
|
CONSTRAINT ql3_plugin_package_lifecycle_plan_json_check CHECK (
|
|
jsonb_typeof(plan_json) = 'object'
|
|
AND octet_length(plan_json::text) BETWEEN 2 AND 98304
|
|
AND plan_json @> jsonb_build_object(
|
|
'schema', 'qinglong/plugin-package-lifecycle-plan@v1',
|
|
'actionRef', action_ref,
|
|
'planDigest', plan_digest,
|
|
'requestedBy', jsonb_build_object(
|
|
'type', requested_by_type,
|
|
'id', requested_by_id
|
|
),
|
|
'plannedAtMs', planned_at_ms,
|
|
'expiresAtMs', expires_at_ms,
|
|
'impact', jsonb_build_object(
|
|
'action', action,
|
|
'impactDigest', impact_digest,
|
|
'target', jsonb_build_object(
|
|
'projectId', project_id,
|
|
'packageName', package_name,
|
|
'installationId', installation_id,
|
|
'lockDigest', lock_digest
|
|
)
|
|
)
|
|
)
|
|
)
|
|
)
|
|
`.trim(),
|
|
`CREATE UNIQUE INDEX ql3_plugin_package_lifecycle_plan_digest_key ON "ql3"."plugin_package_lifecycle_plans" (plan_digest)`,
|
|
`CREATE UNIQUE INDEX ql3_plugin_package_lifecycle_plan_impact_key ON "ql3"."plugin_package_lifecycle_plans" (project_id, package_name, installation_id, lock_digest, impact_digest)`,
|
|
`CREATE INDEX ql3_plugin_package_lifecycle_plan_expiry_idx ON "ql3"."plugin_package_lifecycle_plans" (expires_at_ms, action_ref)`,
|
|
`
|
|
REVOKE ALL ON "ql3"."plugin_package_lifecycle_plans"
|
|
FROM PUBLIC, ql3_runtime, ql3_admin, ql3_package_manager,
|
|
ql3_package_executor, ql3_worker_ingress
|
|
`.trim(),
|
|
`GRANT SELECT ON "ql3"."plugin_package_lifecycle_plans" TO ql3_package_manager, ql3_package_executor`,
|
|
`GRANT INSERT ON "ql3"."plugin_package_lifecycle_plans" TO ql3_package_executor`,
|
|
`
|
|
DO $ql3$
|
|
BEGIN
|
|
UPDATE "ql3"."schema_capabilities"
|
|
SET contract_version = 41,
|
|
migration_id = 'pg-0042-plugin-package-lifecycle-plans',
|
|
capabilities = '${CAPABILITIES_V41}'::jsonb,
|
|
updated_at_ms = floor(
|
|
extract(epoch FROM transaction_timestamp()) * 1000
|
|
)::bigint
|
|
WHERE contract_name = 'control-core'
|
|
AND contract_version = 40
|
|
AND migration_id = 'pg-0041-plugin-package-lifecycle'
|
|
AND capabilities = '${CAPABILITIES_V40}'::jsonb;
|
|
IF NOT FOUND THEN
|
|
RAISE EXCEPTION 'control-core capability is not at version 40'
|
|
USING ERRCODE = 'check_violation';
|
|
END IF;
|
|
END
|
|
$ql3$
|
|
`.trim(),
|
|
],
|
|
});
|