Hare/yoi
1
1
Fork 0
Code Actions Packages Releases Activity

fix: authenticate remote worker removal through workspace router

Browse Source
This commit is contained in:
Hare
2026-09-02 14:43:49 +09:00
parent 14c806d38f
commit 175eda9f29
2 changed files with 185 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/workspace-server/src/server.rs
+113
View File
@@ -21778,6 +21778,119 @@ mod tests {
assert!(!route_body.contains("source"));
assert!(!route_body.contains("proof"));
let outer_path = format!("/api/w/{TEST_WORKSPACE_ID}/workers/remove");
let outer_request_body = r#"{"target_runtime_id":"runtime-target","target_worker_id":"target-worker","reason":"retire target Worker"}"#;
let outer_mutation_token = signer
.issue_worker_remove(
"server-main",
&api.config.workspace_id,
"7",
"runtime-target",
"target-worker",
60,
)
.unwrap();
let outer_request_token =
worker_runtime::auth::RuntimeRequestSourceSigner::from_identity(&identity)
.issue(
"server-main",
&api.config.workspace_id,
Some("7"),
worker_runtime::auth::WORKSPACE_REQUEST_PERMISSION,
"POST",
&outer_path,
outer_request_body.as_bytes(),
i64::try_from(worker_runtime::auth::unix_now_seconds()).unwrap_or(i64::MAX),
30,
)
.unwrap();
let outer_response = build_router(api.clone())
.oneshot(
Request::builder()
.method("POST")
.uri(&outer_path)
.header(CONTENT_TYPE, "application/json")
.header(
worker_runtime::auth::RUNTIME_REQUEST_SOURCE_PROOF_HEADER,
outer_request_token,
)
.header(
worker_runtime::auth::WORKER_MUTATION_SOURCE_PROOF_HEADER,
outer_mutation_token,
)
.body(Body::from(outer_request_body))
.unwrap(),
)
.await
.unwrap();
assert_eq!(outer_response.status(), StatusCode::NOT_FOUND);
let outer_response_body = axum::body::to_bytes(outer_response.into_body(), usize::MAX)
.await
.unwrap();
assert!(
String::from_utf8(outer_response_body.to_vec())
.unwrap()
.contains("unknown_worker")
);
let missing_outer_mutation_token = signer
.issue_worker_remove(
"server-main",
&api.config.workspace_id,
"7",
"runtime-target",
"target-worker",
60,
)
.unwrap();
let missing_outer_response = build_router(api.clone())
.oneshot(
Request::builder()
.method("POST")
.uri(&outer_path)
.header(CONTENT_TYPE, "application/json")
.header(
worker_runtime::auth::WORKER_MUTATION_SOURCE_PROOF_HEADER,
missing_outer_mutation_token,
)
.body(Body::from(outer_request_body))
.unwrap(),
)
.await
.unwrap();
assert_eq!(missing_outer_response.status(), StatusCode::UNAUTHORIZED);
let missing_mutation_request_token =
worker_runtime::auth::RuntimeRequestSourceSigner::from_identity(&identity)
.issue(
"server-main",
&api.config.workspace_id,
Some("7"),
worker_runtime::auth::WORKSPACE_REQUEST_PERMISSION,
"POST",
&outer_path,
outer_request_body.as_bytes(),
i64::try_from(worker_runtime::auth::unix_now_seconds()).unwrap_or(i64::MAX),
30,
)
.unwrap();
let missing_mutation_response = build_router(api.clone())
.oneshot(
Request::builder()
.method("POST")
.uri(&outer_path)
.header(CONTENT_TYPE, "application/json")
.header(
worker_runtime::auth::RUNTIME_REQUEST_SOURCE_PROOF_HEADER,
missing_mutation_request_token,
)
.body(Body::from(outer_request_body))
.unwrap(),
)
.await
.unwrap();
assert_eq!(missing_mutation_response.status(), StatusCode::UNAUTHORIZED);
let mut revoked = trust;
revoked.revoked_at = Some("2026-08-11T00:01:00Z".to_string());
let authority = SqliteWorkspaceStore::open(api.config.database_path.clone()).unwrap();