fix: validate projected resource keys canonically

crates/worker/src/feature/builtin/resource_projection.rs

@@ -649,7 +649,10 @@ fn human_ref(object: &Map<String, Value>, key: &str, prefix: &str) -> Result<Str
 }
 
 fn validate_human_ref(value: String, prefix: &str) -> Result<String, String> {
-    if value.starts_with(prefix) && value.len() > prefix.len() {
+    let valid = value.strip_prefix(prefix).is_some_and(|sequence| {
+        !sequence.is_empty() && sequence.bytes().all(|byte| byte.is_ascii_digit())
+    });
+    if valid {
         Ok(value)
     } else {
         Err(format!("required {prefix} human key is unavailable"))
@@ -768,6 +771,13 @@ mod tests {
         assert!(!objective_json.contains("00001TICKETINTERNAL"));
     }
 
+    #[test]
+    fn human_resource_projection_rejects_noncanonical_keys() {
+        for (key, prefix) in [("T-key", "T-"), ("O-", "O-"), ("W-1x", "W-")] {
+            assert!(validate_human_ref(key.to_string(), prefix).is_err());
+        }
+    }
+
     #[test]
     fn ticket_projection_fails_closed_without_worker_resource_key() {
         let error = project_worker(&json!({"worker_resource_key": null}))

crates/worker/src/feature/builtin/ticket.rs

@@ -778,7 +778,7 @@ impl WorkspaceHttpTicketBackend {
                 if let Some(resource_key) = object
                     .get("resource_key")
                     .and_then(Value::as_str)
-                    .filter(|key| key.starts_with("T-"))
+                    .filter(|key| is_canonical_ticket_resource_key(key))
                     .map(ToOwned::to_owned)
                     && object.contains_key("id")
                 {