Authorize known Worker observations without collection discovery

crates/worker-runtime/src/catalog.rs

@@ -284,8 +284,9 @@ pub struct CreateWorkerRequest {
     pub workdir_attachment_requests: Vec<WorkingDirectoryAttachmentRequest>,
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub workdir_attachments: Vec<WorkingDirectoryAttachmentClaim>,
-    /// Backend-only feature enablement. Grants still define local Runtime peers;
-    /// the Workspace provider reauthorizes its dynamic set per operation.
+    /// Backend-only enablement of the optional Runtime-local peer provider.
+    /// Scoped Backend observation is composed by the Worker Feature, independently
+    /// of this saved flag, and rechecks operation use plus current target control.
     #[serde(default, skip_serializing_if = "is_false")]
     pub worker_observation_enabled: bool,
     /// Backend-authored, bounded peer session grants. Runtime revalidates each

crates/worker-runtime/src/worker_backend.rs

@@ -143,9 +143,6 @@ use workdir::{
 #[cfg(test)]
 use worker::WorkerController;
 use worker::feature::builtin::manage_workdir::WorkspaceAttachedWorkdirSession;
-use worker::feature::builtin::{
-    CompositeWorkerObservationProvider, WorkspaceClientWorkerObservationProvider,
-};
 use worker::feature::contracts::{
     WorkerObservationError, WorkerObservationProvider, WorkerObservationSubject,
     WorkerObservationSubjectRef, WorkerSessionCapture,
@@ -2161,20 +2158,15 @@ impl RuntimeWorkerFactory for ProfileRuntimeWorkerFactory {
         if let (Some(runtime_id), Some(workspace_id)) =
             (observation_runtime_id, observation_workspace_id.clone())
             && observation_enabled
+            && !observation_grants.is_empty()
         {
-            let mut providers: Vec<Arc<dyn WorkerObservationProvider>> = vec![Arc::new(
-                WorkspaceClientWorkerObservationProvider::new(worker.workspace_client_handle()),
-            )];
-            if !observation_grants.is_empty() {
-                providers.push(Arc::new(RuntimeGrantedWorkerObservationProvider {
+            worker.bind_worker_observation_provider(Some(Arc::new(
+                RuntimeGrantedWorkerObservationProvider {
                     runtime_id,
                     workspace_id,
                     grants: observation_grants.into_iter().take(100).collect(),
                     hub: self.observation_hub.clone(),
-                }));
-            }
-            worker.bind_worker_observation_provider(Some(Arc::new(
-                CompositeWorkerObservationProvider::new(providers),
+                },
             )));
         }
         if flow_transition_enabled {
@@ -2877,30 +2869,24 @@ impl ProfileRuntimeWorkerFactory {
                 .expect("retained restore owner")
                 .sessions
                 .push(workdir_sessions.clone());
-            let mut providers: Vec<Arc<dyn WorkerObservationProvider>> = vec![Arc::new(
-                WorkspaceClientWorkerObservationProvider::new(workspace_client.clone()),
-            )];
             let observation_provider = if let (Some(runtime_id), Some(api)) = (
                 self.runtime_id.clone(),
                 request.request.workspace_api.as_ref(),
             ) && request.request.worker_observation_enabled
+                && !request.request.worker_observation_grants.is_empty()
             {
-                if !request.request.worker_observation_grants.is_empty() {
-                    providers.push(Arc::new(RuntimeGrantedWorkerObservationProvider {
-                        runtime_id,
-                        workspace_id: api.workspace_id.clone(),
-                        grants: request
-                            .request
-                            .worker_observation_grants
-                            .iter()
-                            .take(100)
-                            .cloned()
-                            .collect(),
-                        hub: self.observation_hub.clone(),
-                    }));
-                }
-                Some(Arc::new(CompositeWorkerObservationProvider::new(providers))
-                    as Arc<dyn WorkerObservationProvider>)
+                Some(Arc::new(RuntimeGrantedWorkerObservationProvider {
+                    runtime_id,
+                    workspace_id: api.workspace_id.clone(),
+                    grants: request
+                        .request
+                        .worker_observation_grants
+                        .iter()
+                        .take(100)
+                        .cloned()
+                        .collect(),
+                    hub: self.observation_hub.clone(),
+                }) as Arc<dyn WorkerObservationProvider>)
             } else {
                 None
             };

crates/worker-runtime/src/worker_source.rs

@@ -705,6 +705,20 @@ impl WorkspaceClient for RuntimeOwnedWorkspaceClient {
                                 client.worker_control_list(workspace_id).await,
                             )
                         }
+                        WorkspaceServerOperation::WorkerControlAuthorize {
+                            runtime_id,
+                            worker_id,
+                            permission,
+                        } => generated_workspace_response(
+                            client
+                                .worker_control_authorize(
+                                    workspace_id,
+                                    runtime_id,
+                                    worker_id,
+                                    permission,
+                                )
+                                .await,
+                        ),
                         WorkspaceServerOperation::WorkerControlSpawn(request) => {
                             generated_workspace_response(
                                 client.worker_control_spawn(workspace_id, request).await,