feat(api): advance capability and secure operations slices

2026-07-17 11:57:20 +08:00
parent 8018b36adf
commit 1cc4a995ee
19 changed files with 2102 additions and 22 deletions
@@ -228,6 +228,48 @@ export const MIGRATIONS: readonly Migration[] = [
      'CREATE INDEX idx_operation_preparations_status_expires_at ON operation_preparations(status, expires_at)',
    ],
  },
+  {
+    id: 5,
+    name: 'generic-secure-operation-preparation-binding',
+    statements: [
+      `CREATE TABLE operation_preparations_v5 (
+        id TEXT PRIMARY KEY,
+        operation_id TEXT NOT NULL,
+        risk_level TEXT NOT NULL CHECK (risk_level IN ('R2','R3')),
+        status TEXT NOT NULL CHECK (status IN ('prepared','consumed','expired','invalidated')),
+        target_instance_id TEXT NOT NULL,
+        target_revision INTEGER NOT NULL CHECK (target_revision > 0),
+        target_origin TEXT NOT NULL,
+        method TEXT NOT NULL,
+        path TEXT NOT NULL,
+        canonical_query TEXT NOT NULL,
+        body_digest TEXT NOT NULL CHECK (length(body_digest) = 64),
+        content_type TEXT NOT NULL,
+        parameter_schema_id TEXT NOT NULL,
+        parameters_digest TEXT NOT NULL CHECK (length(parameters_digest) = 64),
+        nonce TEXT NOT NULL UNIQUE,
+        token_digest TEXT NOT NULL CHECK (length(token_digest) = 64),
+        requested_by TEXT NOT NULL,
+        request_id TEXT NOT NULL,
+        expires_at TEXT NOT NULL,
+        consumed_at TEXT,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL
+      )`,
+      `INSERT INTO operation_preparations_v5
+       (id,operation_id,risk_level,status,target_instance_id,target_revision,target_origin,method,path,
+        canonical_query,body_digest,content_type,parameter_schema_id,parameters_digest,nonce,token_digest,
+        requested_by,request_id,expires_at,consumed_at,created_at,updated_at)
+       SELECT p.id,p.operation_id,p.risk_level,p.status,p.target_instance_id,p.target_revision,
+        COALESCE(i.base_url,''),'DELETE','/api/v1/instances/' || p.target_instance_id,'',
+        '${createHash('sha256').update('').digest('hex')}','',p.parameter_schema_id,p.parameters_digest,
+        'legacy-' || p.id,p.token_digest,p.requested_by,p.request_id,p.expires_at,p.consumed_at,p.created_at,p.updated_at
+       FROM operation_preparations p LEFT JOIN instances i ON i.id=p.target_instance_id`,
+      'DROP TABLE operation_preparations',
+      'ALTER TABLE operation_preparations_v5 RENAME TO operation_preparations',
+      'CREATE INDEX idx_operation_preparations_status_expires_at ON operation_preparations(status, expires_at)',
+    ],
+  },
 ];

 const createMigrationsTable = `CREATE TABLE schema_migrations (