feat(deploy): add Gelios profile authority transition
This commit is contained in:
Codex
@@ -242,10 +242,10 @@ ENGINE_PROVIDER_SECURITY_CATALOG_ARTIFACT_ENTRIES = (
|
||||
ENGINE_PROVIDER_SECURITY_CATALOG_REL,
|
||||
)
|
||||
ENGINE_PROVIDER_SECURITY_CATALOG_PREDECESSOR_SHA256 = (
|
||||
"1aac712a05e55137d69eedaf363969460ffe866288e8e18e35711967ab232f39"
|
||||
"dd67d8b01091072a4e7be3820b9639c12f2f897ccbbd79208123564d10c1cd81"
|
||||
)
|
||||
ENGINE_PROVIDER_SECURITY_CATALOG_TARGET_SHA256 = (
|
||||
"dd67d8b01091072a4e7be3820b9639c12f2f897ccbbd79208123564d10c1cd81"
|
||||
"773335bb616a5c03eb2108c4f53ef092c02e75ee75f014511201bc12e2956b27"
|
||||
)
|
||||
ENGINE_CONTROL_PLANE_STATE_REL = "nodedc-control-plane"
|
||||
ENGINE_PUBLISH_GRANT_STATE_REL = f"{ENGINE_CONTROL_PLANE_STATE_REL}/publish-grants"
|
||||
@@ -3892,6 +3892,13 @@ def validate_engine_provider_security_catalog_payload(payload_dir, entries):
|
||||
package_ids = [item.get("id") for item in packages if isinstance(item, dict)] \
|
||||
if isinstance(packages, list) else None
|
||||
provider = next(
|
||||
(
|
||||
item for item in packages
|
||||
if isinstance(item, dict) and item.get("id") == "gelios.provider.v8"
|
||||
),
|
||||
None,
|
||||
) if isinstance(packages, list) else None
|
||||
previous_provider = next(
|
||||
(
|
||||
item for item in packages
|
||||
if isinstance(item, dict) and item.get("id") == "gelios.provider.v7"
|
||||
@@ -3911,9 +3918,10 @@ def validate_engine_provider_security_catalog_payload(payload_dir, entries):
|
||||
"gelios.provider.v5",
|
||||
"moscow-department-of-transport.pmd-slow-zones.v1",
|
||||
"gelios.provider.v7",
|
||||
"gelios.provider.v8",
|
||||
]
|
||||
or not isinstance(provider, dict)
|
||||
or provider.get("version") != "7.0.0"
|
||||
or provider.get("version") != "8.0.0"
|
||||
or provider.get("providerId") != "gelios"
|
||||
or credential != {
|
||||
"authModeId": "gelios.rest-rotating-bearer.v3",
|
||||
@@ -3930,13 +3938,41 @@ def validate_engine_provider_security_catalog_payload(payload_dir, entries):
|
||||
"&inclsnsrs=true&incllsv=true"
|
||||
),
|
||||
}
|
||||
or capability.get("dataProductIds") != ["fleet.positions.current.v5"]
|
||||
or capability.get("dataProductIds") != ["fleet.units.profile.current.v1"]
|
||||
or publisher != {
|
||||
"nodeType": "n8n-nodes-ndc.ndcDataProductPublish",
|
||||
"credentialType": "ndcDataProductWriterApi",
|
||||
}
|
||||
or previous_provider != {
|
||||
"id": "gelios.provider.v7",
|
||||
"version": "7.0.0",
|
||||
"providerId": "gelios",
|
||||
"providerCredential": {
|
||||
"authModeId": "gelios.rest-rotating-bearer.v3",
|
||||
"credentialType": "ndcProviderRotatingAccessApi",
|
||||
},
|
||||
"capabilities": [
|
||||
{
|
||||
"id": "gelios.units.current.read",
|
||||
"classification": "read",
|
||||
"status": "implemented",
|
||||
"request": {
|
||||
"method": "GET",
|
||||
"url": (
|
||||
"https://api.geliospro.com/api/v1/units?incltrip=true"
|
||||
"&inclcntrs=true&inclsnsrs=true&incllsv=true"
|
||||
),
|
||||
},
|
||||
"dataProductIds": ["fleet.positions.current.v5"],
|
||||
},
|
||||
],
|
||||
"publisher": {
|
||||
"nodeType": "n8n-nodes-ndc.ndcDataProductPublish",
|
||||
"credentialType": "ndcDataProductWriterApi",
|
||||
},
|
||||
}
|
||||
):
|
||||
die("Engine provider security catalog v7 telemetry projection mismatch")
|
||||
die("Engine provider security catalog v7/v8 projection mismatch")
|
||||
return catalog
|
||||
|
||||
|
||||
@@ -3976,28 +4012,31 @@ def accept_engine_provider_security_catalog_runtime():
|
||||
const module=await import('file:///app/server/dataProductPublishGrant/providerCatalog.js');
|
||||
const catalog=await module.loadProviderSecurityCatalog();
|
||||
const validation=module.validateProviderSecurityCatalog(catalog);
|
||||
const provider=catalog.packages?.find((item)=>item.id==='gelios.provider.v7');
|
||||
const provider=catalog.packages?.find((item)=>item.id==='gelios.provider.v8');
|
||||
const capability=provider?.capabilities?.[0];
|
||||
const slot='ndcProviderRotatingAccessApi';
|
||||
const credential={id:'native-provider',name:'provider',nodeDcCredentialId:'provider-ref'};
|
||||
const policy={kind:'httpRequest',allowedHosts:['api.geliospro.com'],requireHttps:true,disableRedirects:true};
|
||||
const queryParameters={parameters:[{name:'incltrip',value:'true'},{name:'inclcntrs',value:'true'},{name:'inclsnsrs',value:'true'},{name:'incllsv',value:'true'}]};
|
||||
const source={id:'units',data:{n8n:{id:'units',name:'units',type:'n8n-nodes-base.httpRequest',parameters:{method:'GET',url:'https://api.geliospro.com/api/v1/units',sendQuery:true,specifyQuery:'keypair',queryParameters},credentials:{[slot]:credential}},nodedcAgentCredentialPolicies:{[slot]:policy}}};
|
||||
const publish={id:'publish',data:{n8n:{id:'publish',name:'publish',type:'n8n-nodes-ndc.ndcDataProductPublish',parameters:{dataProductId:'fleet.positions.current.v5'},credentials:{}}}};
|
||||
const graph={nodes:[source,publish],edges:[{source:'units',target:'publish'}]};
|
||||
const resolved=module.resolveProviderConnectionFromGraph({graph,targetNodeId:'publish',catalog});
|
||||
const drift=structuredClone(graph);drift.nodes[0].data.n8n.parameters.queryParameters.parameters.pop();
|
||||
const rejected=module.resolveProviderConnectionFromGraph({graph:drift,targetNodeId:'publish',catalog});
|
||||
if(!validation.ok||provider?.providerCredential?.credentialType!==slot||capability?.request?.url!=='https://api.geliospro.com/api/v1/units?incltrip=true&inclcntrs=true&inclsnsrs=true&incllsv=true'||capability?.dataProductIds?.[0]!=='fleet.positions.current.v5'||!resolved.ok||resolved.descriptor?.packageId!=='gelios.provider.v7'||resolved.descriptor?.providerCredentialRef!=='provider-ref'||rejected.blockers?.join(',')!=='publish_grant_provider_request_not_exact')process.exit(2);
|
||||
process.stdout.write('engine-provider-catalog:gelios.provider.v7:ndcProviderRotatingAccessApi:fleet.positions.current.v5');
|
||||
const profilePublish={id:'profile-publish',data:{n8n:{id:'profile-publish',name:'profile-publish',type:'n8n-nodes-ndc.ndcDataProductPublish',parameters:{dataProductId:'fleet.units.profile.current.v1'},credentials:{}}}};
|
||||
const positionsPublish={id:'positions-publish',data:{n8n:{id:'positions-publish',name:'positions-publish',type:'n8n-nodes-ndc.ndcDataProductPublish',parameters:{dataProductId:'fleet.positions.current.v5'},credentials:{}}}};
|
||||
const profileGraph={nodes:[source,profilePublish],edges:[{source:'units',target:'profile-publish'}]};
|
||||
const positionsGraph={nodes:[source,positionsPublish],edges:[{source:'units',target:'positions-publish'}]};
|
||||
const profileResolved=module.resolveProviderConnectionFromGraph({graph:profileGraph,targetNodeId:'profile-publish',catalog});
|
||||
const positionsResolved=module.resolveProviderConnectionFromGraph({graph:positionsGraph,targetNodeId:'positions-publish',catalog});
|
||||
const drift=structuredClone(profileGraph);drift.nodes[0].data.n8n.parameters.queryParameters.parameters.pop();
|
||||
const rejected=module.resolveProviderConnectionFromGraph({graph:drift,targetNodeId:'profile-publish',catalog});
|
||||
if(!validation.ok||provider?.providerCredential?.credentialType!==slot||capability?.request?.url!=='https://api.geliospro.com/api/v1/units?incltrip=true&inclcntrs=true&inclsnsrs=true&incllsv=true'||capability?.dataProductIds?.[0]!=='fleet.units.profile.current.v1'||!profileResolved.ok||profileResolved.descriptor?.packageId!=='gelios.provider.v8'||profileResolved.descriptor?.providerCredentialRef!=='provider-ref'||!positionsResolved.ok||positionsResolved.descriptor?.packageId!=='gelios.provider.v7'||positionsResolved.descriptor?.dataProductId!=='fleet.positions.current.v5'||rejected.blockers?.join(',')!=='publish_grant_provider_request_not_exact')process.exit(2);
|
||||
process.stdout.write('engine-provider-catalog:gelios.provider.v7:fleet.positions.current.v5|gelios.provider.v8:fleet.units.profile.current.v1');
|
||||
""".strip(),
|
||||
),
|
||||
"Engine provider security catalog v7 telemetry",
|
||||
"Engine provider security catalog v8 unit profile",
|
||||
container_id=engine_backend_container_id(),
|
||||
)
|
||||
expected = (
|
||||
"engine-provider-catalog:gelios.provider.v7:"
|
||||
"ndcProviderRotatingAccessApi:fleet.positions.current.v5"
|
||||
"engine-provider-catalog:gelios.provider.v7:fleet.positions.current.v5|"
|
||||
"gelios.provider.v8:fleet.units.profile.current.v1"
|
||||
)
|
||||
if live != expected:
|
||||
die("Engine provider security catalog live acceptance mismatch")
|
||||
@@ -7981,14 +8020,14 @@ def plan_artifact(artifact):
|
||||
print("node_intelligence_image=preserved")
|
||||
print("n8n_l1=untouched")
|
||||
if provider_catalog_preflight:
|
||||
print("engine_provider_catalog_transition=gelios-telemetry-authority-v7")
|
||||
print("engine_provider_package=gelios.provider.v7")
|
||||
print("engine_provider_catalog_transition=gelios-unit-profile-authority-v8")
|
||||
print("engine_provider_package=gelios.provider.v8")
|
||||
print("engine_provider_credential=ndcProviderRotatingAccessApi")
|
||||
print(
|
||||
"engine_provider_endpoint=https://api.geliospro.com/api/v1/units?"
|
||||
"incltrip=true&inclcntrs=true&inclsnsrs=true&incllsv=true"
|
||||
)
|
||||
print("engine_data_product=fleet.positions.current.v5")
|
||||
print("engine_data_product=fleet.units.profile.current.v1")
|
||||
print(
|
||||
"predecessor_catalog_sha256="
|
||||
f"{provider_catalog_preflight['catalog_sha256']}"
|
||||
|
||||
Reference in New Issue
Block a user