Hare/yoi
1
1
Fork 0
Code Actions Packages Releases Activity

workspace: remove worker credential refresh flow

Browse Source
This commit is contained in:
Hare
2026-08-03 17:08:23 +09:00
parent ddadc830ac
commit 0ffaa6c741
17 changed files with 184 additions and 976 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/worker-runtime/src/catalog.rs
-6
View File
@@ -178,8 +178,6 @@ pub struct WorkspaceApiRef {
pub base_url: String,
#[serde(default, skip_serializing_if = "Option::is_none")]
pub runtime_id: Option<String>,
#[serde(default, skip_serializing_if = "Option::is_none")]
pub access_token: Option<String>,
}
impl std::fmt::Debug for WorkspaceApiRef {
@@ -189,10 +187,6 @@ impl std::fmt::Debug for WorkspaceApiRef {
.field("workspace_id", &self.workspace_id)
.field("base_url", &self.base_url)
.field("runtime_id", &self.runtime_id)
.field(
"access_token",
&self.access_token.as_ref().map(|_| "[redacted]"),
)
.finish()
}
}
crates/worker-runtime/src/execution.rs
-21
View File
@@ -31,7 +31,6 @@ pub enum WorkerExecutionOperation {
Restore,
Input,
ProtocolMethod,
ReplaceWorkspaceAccessToken,
Stop,
Cancel,
}
@@ -332,17 +331,6 @@ pub trait WorkerExecutionBackend: Send + Sync + 'static {
Vec::new()
}
fn replace_workspace_access_token(
&self,
_handle: &WorkerExecutionHandle,
_access_token: String,
) -> WorkerExecutionResult {
WorkerExecutionResult::unsupported(
WorkerExecutionOperation::ReplaceWorkspaceAccessToken,
"execution backend does not support replacing Workspace access tokens",
)
}
fn stop_worker(&self, _handle: &WorkerExecutionHandle) -> WorkerExecutionResult {
WorkerExecutionResult::unsupported(
WorkerExecutionOperation::Stop,
@@ -455,15 +443,6 @@ impl WorkerExecutionBackendRef {
self.backend.worker_completions(handle, kind, prefix)
}
pub(crate) fn replace_workspace_access_token(
&self,
handle: &WorkerExecutionHandle,
access_token: String,
) -> WorkerExecutionResult {
self.backend
.replace_workspace_access_token(handle, access_token)
}
pub(crate) fn stop_worker(&self, handle: &WorkerExecutionHandle) -> WorkerExecutionResult {
self.backend.stop_worker(handle)
}
crates/worker-runtime/src/http_server.rs
-13
View File
@@ -1466,7 +1466,6 @@ mod tests {
workspace_id: workspace_id.to_string(),
base_url: format!("https://workspace.example/{workspace_id}"),
runtime_id: None,
access_token: None,
});
request
}
@@ -1796,17 +1795,6 @@ mod tests {
)
}
fn replace_workspace_access_token(
&self,
_handle: &WorkerExecutionHandle,
_access_token: String,
) -> WorkerExecutionResult {
WorkerExecutionResult::accepted(
WorkerExecutionOperation::ReplaceWorkspaceAccessToken,
WorkerExecutionRunState::Idle,
)
}
fn stop_worker(&self, _handle: &WorkerExecutionHandle) -> WorkerExecutionResult {
WorkerExecutionResult::accepted(
WorkerExecutionOperation::Stop,
@@ -1908,7 +1896,6 @@ mod tests {
workspace_id: "local".to_string(),
base_url: "http://127.0.0.1:8787".to_string(),
runtime_id: None,
access_token: Some("workspace-access-token".to_string()),
},
},
)
crates/worker-runtime/src/runtime.rs
+6 -67
View File
@@ -720,8 +720,7 @@ impl Runtime {
Ok(())
}
/// Replace the Workspace API binding persisted for a Worker and update the
/// live execution when one is connected.
/// Replace the Workspace API identity binding persisted for a Worker.
pub fn replace_worker_workspace_api_scoped(
&self,
scope: &RuntimeWorkspaceScope,
@@ -743,17 +742,7 @@ impl Runtime {
worker_ref: &WorkerRef,
workspace_api: WorkspaceApiRef,
) -> Result<WorkerDetail, RuntimeError> {
let access_token = workspace_api
.access_token
.as_ref()
.filter(|token| !token.trim().is_empty())
.cloned()
.ok_or_else(|| {
RuntimeError::InvalidRequest(
"Workspace API replacement requires an access token".to_string(),
)
})?;
let (previous_workspace_api, live_execution) = {
let previous_workspace_api = {
let state = self.lock()?;
let worker = state.worker(worker_ref)?;
if let Some(existing) = worker.request.workspace_api.as_ref()
@@ -769,14 +758,7 @@ impl Runtime {
.to_string(),
));
}
let live_execution = match (
state.execution_backend.clone(),
worker.execution_handle.clone(),
) {
(Some(backend), Some(handle)) => Some((backend, handle)),
_ => None,
};
(worker.request.workspace_api.clone(), live_execution)
worker.request.workspace_api.clone()
};
{
@@ -788,22 +770,6 @@ impl Runtime {
}
}
if let Some((backend, handle)) = live_execution {
let result = backend.replace_workspace_access_token(&handle, access_token);
if !result.is_accepted() {
let mut state = self.lock()?;
state.worker_mut(worker_ref)?.request.workspace_api = previous_workspace_api;
state.persist_runtime_snapshot()?;
return Err(RuntimeError::WorkerExecutionRejected {
worker_id: worker_ref.worker_id.clone(),
operation: result.operation,
outcome: result.outcome,
message: result.message_or_default(),
result,
});
}
}
let state = self.lock()?;
Ok(state.worker(worker_ref)?.detail())
}
@@ -1163,8 +1129,7 @@ impl Runtime {
WorkerExecutionOperation::Spawn
| WorkerExecutionOperation::Restore
| WorkerExecutionOperation::Input
| WorkerExecutionOperation::ProtocolMethod
| WorkerExecutionOperation::ReplaceWorkspaceAccessToken => return Ok(()),
| WorkerExecutionOperation::ProtocolMethod => return Ok(()),
};
if result.is_accepted() {
return Ok(());
@@ -2475,7 +2440,6 @@ mod tests {
workspace_id: workspace_id.to_string(),
base_url: format!("https://workspace.example/{workspace_id}"),
runtime_id: None,
access_token: None,
});
request
}
@@ -2518,7 +2482,6 @@ mod tests {
restore_result: Mutex<Option<WorkerExecutionSpawnResult>>,
restore_count: Mutex<u64>,
contexts: Mutex<BTreeMap<WorkerId, WorkerExecutionContext>>,
workspace_access_tokens: Mutex<BTreeMap<WorkerId, String>>,
#[cfg(feature = "ws-server")]
snapshots: Mutex<BTreeMap<WorkerId, protocol::Event>>,
}
@@ -2607,21 +2570,6 @@ mod tests {
})
}
fn replace_workspace_access_token(
&self,
handle: &WorkerExecutionHandle,
access_token: String,
) -> WorkerExecutionResult {
self.workspace_access_tokens
.lock()
.unwrap()
.insert(handle.worker_ref().worker_id.clone(), access_token);
WorkerExecutionResult::accepted(
WorkerExecutionOperation::ReplaceWorkspaceAccessToken,
WorkerExecutionRunState::Idle,
)
}
fn stop_worker(&self, _handle: &WorkerExecutionHandle) -> WorkerExecutionResult {
WorkerExecutionResult::accepted(
WorkerExecutionOperation::Stop,
@@ -2899,8 +2847,8 @@ mod tests {
}
#[test]
fn workspace_api_replacement_updates_live_execution_and_persisted_request() {
let (runtime, backend) = runtime_and_backend();
fn workspace_api_replacement_updates_persisted_request() {
let (runtime, _backend) = runtime_and_backend();
let scope = scope("workspace-a", "server-a");
let worker = runtime
.create_worker_scoped(
@@ -2912,21 +2860,12 @@ mod tests {
workspace_id: "workspace-a".to_string(),
base_url: "https://workspace.example/workspace-a/".to_string(),
runtime_id: Some("runtime-a".to_string()),
access_token: Some("replacement-token".to_string()),
};
runtime
.replace_worker_workspace_api_scoped(&scope, &worker.worker_ref, replacement.clone())
.unwrap();
assert_eq!(
backend
.workspace_access_tokens
.lock()
.unwrap()
.get(&worker.worker_ref.worker_id),
Some(&"replacement-token".to_string())
);
let state = runtime.lock().unwrap();
assert_eq!(
state
crates/worker-runtime/src/worker_backend.rs
+16 -42
View File
@@ -261,17 +261,22 @@ enum RuntimeWorkspaceBackendRef {
Http {
workspace_id: String,
base_url: String,
access_token: Option<String>,
runtime_id: String,
},
}
impl RuntimeWorkspaceBackendRef {
fn from_worker_request(request: &CreateWorkerRequest) -> Self {
if let Some(api) = request.workspace_api.as_ref() {
if let Some(api) = request.workspace_api.as_ref()
&& let Some(runtime_id) = api
.runtime_id
.as_ref()
.filter(|runtime_id| !runtime_id.trim().is_empty())
{
return Self::Http {
workspace_id: api.workspace_id.clone(),
base_url: api.base_url.clone(),
access_token: api.access_token.clone(),
runtime_id: runtime_id.clone(),
};
}
Self::None
@@ -283,17 +288,15 @@ impl RuntimeWorkspaceBackendRef {
Self::Http {
workspace_id,
base_url,
access_token,
runtime_id,
} => WorkerWorkspaceContext::with_client(
WorkspaceId::new(workspace_id.clone()).ok(),
Arc::new(
RuntimeWorkspaceHttpClient::new(
workspace_id.clone(),
base_url.clone(),
worker_ref.worker_id.to_string(),
)
.with_access_token(access_token.clone()),
),
Arc::new(RuntimeWorkspaceHttpClient::new(
workspace_id.clone(),
base_url.clone(),
runtime_id.clone(),
worker_ref.worker_id.to_string(),
)),
),
}
}
@@ -1160,34 +1163,6 @@ where
result
}
fn replace_workspace_access_token(
&self,
handle: &WorkerExecutionHandle,
access_token: String,
) -> WorkerExecutionResult {
let (worker, _busy) = match self.get_execution(handle) {
Ok(execution) => execution,
Err(mut result) => {
result.operation = WorkerExecutionOperation::ReplaceWorkspaceAccessToken;
return result;
}
};
worker
.replace_workspace_access_token(access_token)
.map(|_| {
WorkerExecutionResult::accepted(
WorkerExecutionOperation::ReplaceWorkspaceAccessToken,
WorkerExecutionRunState::Idle,
)
})
.unwrap_or_else(|error| {
WorkerExecutionResult::errored(
WorkerExecutionOperation::ReplaceWorkspaceAccessToken,
error.to_string(),
)
})
}
fn stop_worker(&self, handle: &WorkerExecutionHandle) -> WorkerExecutionResult {
if handle.backend_id() != self.backend_id() {
return WorkerExecutionResult::rejected(
@@ -1775,8 +1750,7 @@ mod tests {
request.workspace_api = Some(crate::catalog::WorkspaceApiRef {
workspace_id: "ws-test".to_string(),
base_url: "http://127.0.0.1:3999".to_string(),
runtime_id: None,
access_token: None,
runtime_id: Some("runtime-test".to_string()),
});
let detail = runtime.create_worker(request).unwrap();