fix: declare NC01 Monitor PostgreSQL consumer

2026-07-12 19:59:08 +00:00
parent 4c54ca7797
commit 9a7d824955
2 changed files with 98 additions and 1 deletions
@@ -0,0 +1,48 @@
+import { describe, expect, test } from "bun:test";
+import { rootPath } from "./config";
+import { readYamlRecord } from "./platform-infra-ops-library";
+
+describe("NC01 Host PG Monitor declaration", () => {
+  test("声明独立 Monitor role、database、SCRAM HBA 与 DATABASE_URL consumer", () => {
+    const config = readYamlRecord<Record<string, any>>(rootPath("config/platform-db/postgres-nc01.yaml"), "postgres-host-cluster");
+    const monitorRole = config.objects.roles.find((role: Record<string, unknown>) => role.name === "web_probe_monitor");
+    const monitorDatabase = config.objects.databases.find((database: Record<string, unknown>) => database.name === "web_probe_monitor");
+    const monitorHba = config.postgres.auth.pgHba.find((rule: Record<string, unknown>) => rule.database === "web_probe_monitor" && rule.user === "web_probe_monitor");
+    const monitorExport = config.exports.connectionStrings.find((entry: Record<string, unknown>) => entry.name === "web-probe-monitor-nc01-database-url");
+
+    expect(config.metadata.relatedIssues).toContain(1875);
+    expect(config.secrets.entries).toEqual(expect.arrayContaining([
+      expect.objectContaining({
+        sourceRef: "platform-db/web-probe-monitor-nc01-db.env",
+        requiredKeys: [
+          "WEB_PROBE_MONITOR_NC01_DB_USER",
+          "WEB_PROBE_MONITOR_NC01_DB_PASSWORD",
+          "WEB_PROBE_MONITOR_NC01_DB_NAME",
+        ],
+      }),
+    ]));
+    expect(monitorRole).toMatchObject({
+      passwordRef: { sourceRef: "platform-db/web-probe-monitor-nc01-db.env", key: "WEB_PROBE_MONITOR_NC01_DB_PASSWORD" },
+      login: true,
+      attributes: { createdb: false, createrole: false, superuser: false },
+    });
+    expect(monitorDatabase).toMatchObject({ owner: "web_probe_monitor", encoding: "UTF8", locale: "C.UTF-8" });
+    expect(monitorHba).toEqual({ type: "hostssl", database: "web_probe_monitor", user: "web_probe_monitor", address: "10.42.0.0/16", method: "scram-sha-256" });
+    expect(monitorExport).toMatchObject({
+      sourceSecretRef: "platform-db/web-probe-monitor-nc01-db.env",
+      render: { envKey: "DATABASE_URL", variables: { PGHOST: "10.42.0.1" } },
+      writeToSecretSource: { sourceRef: "hwlab/web-probe-monitor-db.env", key: "DATABASE_URL", mode: "update-or-insert" },
+      consumers: [{ scope: "hwlab-web-probe-monitor", secret: "hwlab-web-probe-monitor-db", key: "DATABASE_URL" }],
+    });
+    expect(monitorExport.render.format).not.toContain("web_probe_monitor:");
+  });
+
+  test("既有应用 role 保持原有独立 sourceRef", () => {
+    const config = readYamlRecord<Record<string, any>>(rootPath("config/platform-db/postgres-nc01.yaml"), "postgres-host-cluster");
+    const sourceRefs = new Map(config.objects.roles.map((role: Record<string, any>) => [role.name, role.passwordRef.sourceRef]));
+
+    expect(sourceRefs.get("agentrun_v02")).toBe("platform-db/agentrun-nc01-v02-db.env");
+    expect(sourceRefs.get("decision_center")).toBe("decision-center/nc01-db.env");
+    expect(sourceRefs.get("web_probe_monitor")).toBe("platform-db/web-probe-monitor-nc01-db.env");
+  });
+});