From d281b560746b0cd61b018a5d628490685b62d210 Mon Sep 17 00:00:00 2001
From: Codex <codex@local>
Date: Wed, 15 Jul 2026 03:13:13 +0200
Subject: [PATCH] =?UTF-8?q?feat:=20=E5=A3=B0=E6=98=8E=20PikaOA=20=E7=8B=AC?=
 =?UTF-8?q?=E7=AB=8B=E6=B5=8B=E8=AF=95=E6=95=B0=E6=8D=AE=E5=BA=93?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 config/platform-db/postgres-pk01.yaml | 58 +++++++++++++++++++++++++++
 scripts/src/platform-db.ts            | 29 +++++++-------
 2 files changed, 73 insertions(+), 14 deletions(-)

diff --git a/config/platform-db/postgres-pk01.yaml b/config/platform-db/postgres-pk01.yaml
index 8795f1c6..276cf0bd 100644
--- a/config/platform-db/postgres-pk01.yaml
+++ b/config/platform-db/postgres-pk01.yaml
@@ -10,6 +10,7 @@ metadata:
     - 281
     - 297
     - 300
+    - 2078
 
 cluster:
   role: primary
@@ -374,6 +375,16 @@ postgres:
         user: pikaoa
         address: 152.53.229.148/32
         method: scram-sha-256
+      - type: hostssl
+        database: pikaoa_test
+        user: pikaoa_test
+        address: 10.0.8.0/22
+        method: scram-sha-256
+      - type: hostssl
+        database: pikaoa_test
+        user: pikaoa_test
+        address: 152.53.229.148/32
+        method: scram-sha-256
 
 secrets:
   source: master-local
@@ -491,6 +502,20 @@ secrets:
           PIKAOA_DB_NAME: pikaoa
         randomHex:
           PIKAOA_DB_PASSWORD: 32
+    - name: pikaoa-test-db-credentials
+      sourceRef: platform-db/pikaoa-test-db.env
+      type: env
+      requiredKeys:
+        - PIKAOA_TEST_DB_USER
+        - PIKAOA_TEST_DB_PASSWORD
+        - PIKAOA_TEST_DB_NAME
+      createIfMissing:
+        enabled: true
+        values:
+          PIKAOA_TEST_DB_USER: pikaoa_test
+          PIKAOA_TEST_DB_NAME: pikaoa_test
+        randomHex:
+          PIKAOA_TEST_DB_PASSWORD: 32
 objects:
   roles:
     - name: sub2api
@@ -565,6 +590,15 @@ objects:
         createdb: false
         createrole: false
         superuser: false
+    - name: pikaoa_test
+      passwordRef:
+        sourceRef: platform-db/pikaoa-test-db.env
+        key: PIKAOA_TEST_DB_PASSWORD
+      login: true
+      attributes:
+        createdb: false
+        createrole: false
+        superuser: false
   databases:
     - name: sub2api
       owner: sub2api
@@ -606,6 +640,11 @@ objects:
       encoding: UTF8
       locale: C.UTF-8
       extensions: []
+    - name: pikaoa_test
+      owner: pikaoa_test
+      encoding: UTF8
+      locale: C.UTF-8
+      extensions: []
 
 exports:
   connectionStrings:
@@ -764,6 +803,22 @@ exports:
         - scope: pikaoa
           secret: pikaoa-runtime
           key: DATABASE_URL
+    - name: pikaoa-test-database-url
+      sourceSecretRef: platform-db/pikaoa-test-db.env
+      render:
+        envKey: DATABASE_URL
+        format: postgresql://$(PIKAOA_TEST_DB_USER):$(PIKAOA_TEST_DB_PASSWORD)@$(PGHOST):$(PGPORT)/$(PIKAOA_TEST_DB_NAME)?sslmode=require
+        variables:
+          PGHOST: 82.156.23.220
+          PGPORT: "5432"
+      writeToSecretSource:
+        sourceRef: platform-infra/pikaoa-test.env
+        key: DATABASE_URL
+        mode: update-or-insert
+      consumers:
+        - scope: pikaoa-test
+          secret: pikaoa-test-runtime
+          key: DATABASE_URL
 
 backup:
   phase: minimum-restoreable
@@ -812,6 +867,9 @@ observability:
     - kind: psql-app-role
       database: pikaoa
       user: pikaoa
+    - kind: psql-app-role
+      database: pikaoa_test
+      user: pikaoa_test
     - kind: disk-free
       path: /var/lib/postgresql/16/main
       minFreeGiB: 10
diff --git a/scripts/src/platform-db.ts b/scripts/src/platform-db.ts
index c5da285a..377618f7 100644
--- a/scripts/src/platform-db.ts
+++ b/scripts/src/platform-db.ts
@@ -1113,27 +1113,28 @@ function compactPlan(
       transport: pg.postgres.network.transport,
       sslmode: pg.postgres.network.sslmode,
     },
-    roles: pg.objects.roles.map((role) => ({
+    roles: compactActionableSummary(pg.objects.roles.map((role) => ({
       name: role.name,
       exists: observedRoles.find((item) => item.name === role.name)?.exists ?? null,
       action: observedRoles.some((item) => item.name === role.name && item.exists) ? "none" : "create-or-update",
-    })),
-    databases: pg.objects.databases.map((database) => ({
+    })), {
+      passed: (item) => item.action === "none",
+      missing: (item) => item.exists !== true,
+      actionable: (item) => item.action !== "none",
+      project: (item) => item,
+    }),
+    databases: compactActionableSummary(pg.objects.databases.map((database) => ({
       name: database.name,
       owner: database.owner,
       exists: observedDatabases.find((item) => item.name === database.name)?.exists ?? null,
       action: observedDatabases.some((item) => item.name === database.name && item.exists) ? "none" : "create",
-    })),
-    secrets: {
-      ok: secrets.ok,
-      root: secrets.root,
-      entries: secrets.entries.map((entry) => ({
-        sourceRef: entry.sourceRef,
-        missingKeys: entry.missingKeys,
-        action: entry.action,
-      })),
-      valuesPrinted: false,
-    },
+    })), {
+      passed: (item) => item.action === "none",
+      missing: (item) => item.exists !== true,
+      actionable: (item) => item.action !== "none",
+      project: (item) => item,
+    }),
+    secrets: compactSecretInspection(secrets),
     exports: pg.exports.connectionStrings.map((item) => ({
       name: item.name,
       sourceRef: item.sourceSecretRef,