Hare/yoi
1
1
Fork 0
Code Actions Packages Releases Activity

fix: gate runtime key reveal and revoke confirmation

Browse Source
This commit is contained in:
Hare
2026-09-06 05:50:29 +09:00
parent 5686bbc9fd
commit 5fd2ccf084
9 changed files with 253 additions and 71 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/client/src/workspace_product.rs
+13 -3
View File
@@ -13,9 +13,9 @@ use workspace_api::{
CreateWorkspaceWorkerRequest, ListResponse, MemoryDocumentResponse, MemoryStagingListResponse,
ObjectiveCreateRequest, ObjectiveDetail, ObjectiveEditRequest, ObjectiveLinkTicketRequest,
ObjectiveStateRequest, ObjectiveSummary, PutRuntimeTrustKeyRequest,
RevokeRuntimeTrustKeyRequest, TICKET_ORCHESTRATION_PLANS_QUERY_PATH,
TICKET_RELATIONS_QUERY_PATH, WorkerLaunchOptionsResponse, WorkspaceRuntimeDetail,
WorkspaceRuntimeResource,
RevokeRuntimeTrustKeyRequest, RuntimeTrustKeyRevealResponse,
TICKET_ORCHESTRATION_PLANS_QUERY_PATH, TICKET_RELATIONS_QUERY_PATH,
WorkerLaunchOptionsResponse, WorkspaceRuntimeDetail, WorkspaceRuntimeResource,
};
use crate::{BackendApiClient, BackendWorkspaceClientError};
@@ -256,6 +256,16 @@ impl BackendWorkspaceProductClient {
self.get_json(&format!("/runtimes/{}", encode_path_segment(runtime_id)))
}
pub fn reveal_runtime_trust_key(
&self,
runtime_id: &str,
) -> Result<RuntimeTrustKeyRevealResponse, BackendWorkspaceClientError> {
self.get_json(&format!(
"/runtimes/{}/trust-key",
encode_path_segment(runtime_id)
))
}
pub fn put_runtime_trust_key(
&self,
runtime_id: &str,
crates/workspace-api/src/lib.rs
+15 -3
View File
@@ -1220,8 +1220,6 @@ pub enum RuntimeTrustKeyStatus {
pub struct RuntimeTrustKeyState {
pub status: RuntimeTrustKeyStatus,
#[serde(default, skip_serializing_if = "Option::is_none")]
pub public_key: Option<String>,
#[serde(default, skip_serializing_if = "Option::is_none")]
pub fingerprint: Option<String>,
#[serde(default, skip_serializing_if = "Option::is_none")]
#[cfg_attr(feature = "typescript", ts(type = "number | null"))]
@@ -1272,6 +1270,13 @@ pub struct WorkspaceRuntimeDetail {
pub recent_audit: Vec<RuntimeTrustAuditEntry>,
}
#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
#[cfg_attr(feature = "typescript", derive(ts_rs::TS))]
#[serde(deny_unknown_fields)]
pub struct RuntimeTrustKeyRevealResponse {
pub public_key: String,
}
#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
#[cfg_attr(feature = "typescript", derive(ts_rs::TS))]
#[serde(deny_unknown_fields)]
@@ -2522,6 +2527,7 @@ pub fn catalog_typescript() -> String {
RuntimeTrustAuditAction::decl(&config),
RuntimeTrustAuditEntry::decl(&config),
WorkspaceRuntimeDetail::decl(&config),
RuntimeTrustKeyRevealResponse::decl(&config),
PutRuntimeTrustKeyRequest::decl(&config),
RevokeRuntimeTrustKeyRequest::decl(&config),
RuntimeTrustConflictKind::decl(&config),
@@ -3250,7 +3256,6 @@ mod tests {
"endpoint": "https://runtime.example",
"trust_key": {
"status": "active",
"public_key": "ssh-ed25519 AAAA runtime-test",
"fingerprint": "SHA256:test",
"revision": 2,
"created_at": "2026-09-01T12:00:00Z",
@@ -3271,6 +3276,13 @@ mod tests {
let mut unknown = detail;
unknown["trust_key"]["private_key"] = serde_json::json!("forbidden");
assert!(serde_json::from_value::<WorkspaceRuntimeDetail>(unknown).is_err());
assert!(
serde_json::from_value::<RuntimeTrustKeyRevealResponse>(serde_json::json!({
"public_key": "yoi-ed25519-pub:v1:key",
"private_key": "forbidden"
}))
.is_err()
);
assert!(
serde_json::from_value::<PutRuntimeTrustKeyRequest>(serde_json::json!({
"public_key": "key",
crates/workspace-server/src/server.rs
+61 -25
View File
@@ -78,10 +78,11 @@ use workspace_api::{
RequestActor, RevokeRuntimeTrustKeyRequest, RotateRepositorySshCredentialRequest,
RuntimeConnectionTestFailureKind, RuntimeConnectionTestResponse, RuntimeConnectionTestStatus,
RuntimeManagementSummary, RuntimeTrustAuditAction, RuntimeTrustAuditEntry,
RuntimeTrustConflictKind, RuntimeTrustConflictResponse, RuntimeTrustKeyState,
RuntimeTrustKeyStatus, TICKET_ORCHESTRATION_PLANS_QUERY_PATH, TICKET_RELATIONS_QUERY_PATH,
UpdateWorkspaceMetadataRequest, WhoamiResponse, WorkerLaunchOptionsResponse,
WorkerLaunchProfileCandidate, WorkerLaunchRuntimeOption, WorkerLaunchWorkerSummary,
RuntimeTrustConflictKind, RuntimeTrustConflictResponse, RuntimeTrustKeyRevealResponse,
RuntimeTrustKeyState, RuntimeTrustKeyStatus, TICKET_ORCHESTRATION_PLANS_QUERY_PATH,
TICKET_RELATIONS_QUERY_PATH, UpdateWorkspaceMetadataRequest, WhoamiResponse,
WorkerLaunchOptionsResponse, WorkerLaunchProfileCandidate, WorkerLaunchRuntimeOption,
WorkerLaunchWorkerSummary,
WorkingDirectoryCreateRequest as BrowserWorkingDirectoryCreateRequest,
WorkingDirectoryCreateResponse as BrowserWorkingDirectoryCreateResponse,
WorkingDirectoryDetailResponse as BrowserWorkingDirectoryDetailResponse,
@@ -2672,7 +2673,9 @@ fn build_inner_router(api: WorkspaceApi) -> Router {
)
.route(
"/api/w/{workspace_id}/runtimes/{runtime_id}/trust-key",
put(scoped_put_runtime_trust_key).delete(scoped_revoke_runtime_trust_key),
get(scoped_reveal_runtime_trust_key)
.put(scoped_put_runtime_trust_key)
.delete(scoped_revoke_runtime_trust_key),
)
.route(
"/api/w/{workspace_id}/runtimes/{runtime_id}/connection-tests",
@@ -10884,20 +10887,44 @@ async fn scoped_create_remote_runtime(
async fn scoped_get_runtime_detail(
State(api): State<WorkspaceApi>,
AxumPath(path): AxumPath<ScopedRuntimePath>,
Extension(actor): Extension<RequestActor>,
) -> ApiResult<Json<WorkspaceRuntimeDetail>> {
validate_workspace_scope(&api, &path.workspace_id)?;
let workspace = api
.store
.get_workspace(&path.workspace_id)
.await?
.ok_or(Error::WorkspaceIdMismatch)?;
let is_owner = workspace.owner_account_id == actor.account_id;
Ok(Json(
workspace_runtime_detail(&api, &path.workspace_id, &path.runtime_id, is_owner).await?,
workspace_runtime_detail(&api, &path.workspace_id, &path.runtime_id).await?,
))
}
async fn scoped_reveal_runtime_trust_key(
State(api): State<WorkspaceApi>,
AxumPath(path): AxumPath<ScopedRuntimePath>,
Extension(actor): Extension<RequestActor>,
) -> ApiResult<Json<RuntimeTrustKeyRevealResponse>> {
validate_workspace_scope(&api, &path.workspace_id)?;
require_workspace_owner(
&api,
&path.workspace_id,
&actor,
"Runtime public key reveal",
)
.await?;
if path.runtime_id == EMBEDDED_WORKER_RUNTIME_ID {
return Err(settings_bad_request(
"embedded_runtime_trust_managed_internally",
"the embedded Runtime trust key is managed by Server identity authority",
));
}
let binding = api
.store
.get_workspace_runtime_binding(&path.workspace_id, &path.runtime_id)
.await?
.ok_or_else(|| Error::RuntimeBindingNotFound {
runtime_id: path.runtime_id.clone(),
})?;
Ok(Json(RuntimeTrustKeyRevealResponse {
public_key: binding.public_key,
}))
}
async fn scoped_put_runtime_trust_key(
State(api): State<WorkspaceApi>,
AxumPath(path): AxumPath<ScopedRuntimePath>,
@@ -10993,7 +11020,7 @@ async fn scoped_put_runtime_trust_key(
.register_remote_runtime(source);
}
Ok(
Json(workspace_runtime_detail(&api, &path.workspace_id, &path.runtime_id, true).await?)
Json(workspace_runtime_detail(&api, &path.workspace_id, &path.runtime_id).await?)
.into_response(),
)
}
@@ -11046,7 +11073,7 @@ async fn scoped_revoke_runtime_trust_key(
api.runtime_subscription_broker
.unregister_runtime(&path.runtime_id);
Ok(
Json(workspace_runtime_detail(&api, &path.workspace_id, &path.runtime_id, true).await?)
Json(workspace_runtime_detail(&api, &path.workspace_id, &path.runtime_id).await?)
.into_response(),
)
}
@@ -14738,7 +14765,6 @@ async fn workspace_runtime_detail(
api: &WorkspaceApi,
workspace_id: &str,
runtime_id: &str,
include_public_key: bool,
) -> ApiResult<WorkspaceRuntimeDetail> {
let binding = api
.store
@@ -14800,7 +14826,6 @@ async fn workspace_runtime_detail(
let trust_key = binding.as_ref().map_or(
RuntimeTrustKeyState {
status: RuntimeTrustKeyStatus::Unconfigured,
public_key: None,
fingerprint: None,
revision: None,
created_at: None,
@@ -14813,7 +14838,6 @@ async fn workspace_runtime_detail(
} else {
RuntimeTrustKeyStatus::Active
},
public_key: include_public_key.then(|| binding.public_key.clone()),
fingerprint: Some(binding.public_key_fingerprint.clone()),
revision: Some(binding.binding_revision),
created_at: Some(binding.created_at.clone()),
@@ -22529,7 +22553,18 @@ mod tests {
.await
.unwrap();
let Json(owner_detail) = scoped_get_runtime_detail(
let Json(detail) = scoped_get_runtime_detail(
State(api.clone()),
AxumPath(ScopedRuntimePath {
workspace_id: TEST_WORKSPACE_ID.to_string(),
runtime_id: "runtime-a".to_string(),
}),
)
.await
.unwrap();
assert_eq!(detail.trust_key.revision, Some(1));
assert!(detail.trust_key.fingerprint.is_some());
let Json(revealed) = scoped_reveal_runtime_trust_key(
State(api.clone()),
AxumPath(ScopedRuntimePath {
workspace_id: TEST_WORKSPACE_ID.to_string(),
@@ -22539,9 +22574,8 @@ mod tests {
)
.await
.unwrap();
assert!(owner_detail.trust_key.public_key.is_some());
assert_eq!(owner_detail.trust_key.revision, Some(1));
let Json(reader_detail) = scoped_get_runtime_detail(
assert!(revealed.public_key.starts_with("yoi-ed25519-pub:v1:"));
let denied_reveal = scoped_reveal_runtime_trust_key(
State(api.clone()),
AxumPath(ScopedRuntimePath {
workspace_id: TEST_WORKSPACE_ID.to_string(),
@@ -22550,9 +22584,11 @@ mod tests {
Extension(non_owner.clone()),
)
.await
.unwrap();
assert!(reader_detail.trust_key.public_key.is_none());
assert!(reader_detail.trust_key.fingerprint.is_some());
.unwrap_err();
assert_eq!(
denied_reveal.into_response().status(),
StatusCode::FORBIDDEN
);
let response = scoped_put_runtime_trust_key(
State(api.clone()),
web/workspace/src/lib/generated/workspace-api.ts
+2 -1
View File
@@ -276,7 +276,6 @@ export type RuntimeTrustKeyStatus = "unconfigured" | "active" | "revoked";
export type RuntimeTrustKeyState = {
status: RuntimeTrustKeyStatus;
public_key?: string | null;
fingerprint?: string | null;
revision?: number | null;
created_at?: string | null;
@@ -307,6 +306,8 @@ export type WorkspaceRuntimeDetail = {
recent_audit: Array<RuntimeTrustAuditEntry>;
};
export type RuntimeTrustKeyRevealResponse = { public_key: string };
export type PutRuntimeTrustKeyRequest = {
public_key: string;
expected_revision: number | null;
web/workspace/src/lib/workspace/api/runtime-management.ts
+43 -13
View File
@@ -11,6 +11,7 @@ import type {
RuntimeTrustAuditEntry,
RuntimeTrustConflictKind,
RuntimeTrustConflictResponse,
RuntimeTrustKeyRevealResponse,
RuntimeTrustKeyState,
RuntimeTrustKeyStatus,
WorkspaceRuntimeDetail,
@@ -354,23 +355,11 @@ function trustKey(value: unknown, path: string): RuntimeTrustKeyState {
exactKeys(
item,
["status"],
[
"public_key",
"fingerprint",
"revision",
"created_at",
"updated_at",
"revoked_at",
],
["fingerprint", "revision", "created_at", "updated_at", "revoked_at"],
path,
);
const result: RuntimeTrustKeyState = {
status: enumValue(item.status, `${path}.status`, TRUST_STATUSES),
public_key: optionalNullableString(
item.public_key,
`${path}.public_key`,
LIMITS.publicKeyBytes,
),
fingerprint: optionalNullableString(
item.fingerprint,
`${path}.fingerprint`,
@@ -538,6 +527,25 @@ export function parseWorkspaceRuntimeDetail(
};
}
export function parseRuntimeTrustKeyRevealResponse(
value: unknown,
): RuntimeTrustKeyRevealResponse {
const response = object(value, "Runtime trust key reveal response");
exactKeys(
response,
["public_key"],
[],
"Runtime trust key reveal response",
);
return {
public_key: boundedString(
response.public_key,
"Runtime trust key reveal response.public_key",
LIMITS.publicKeyBytes,
),
};
}
export function parseRuntimeTrustConflict(
value: unknown,
): RuntimeTrustConflictResponse {
@@ -677,6 +685,21 @@ async function finishMutation(
return detail;
}
export async function revealRuntimeTrustKey(
workspaceId: string,
runtimeId: string,
): Promise<RuntimeTrustKeyRevealResponse> {
const response = await fetch(
workspaceApiPath(
workspaceId,
`/runtimes/${encodeURIComponent(runtimeId)}/trust-key`,
),
);
const payload = await readBoundedJson(response);
if (!response.ok) throw requestErrorFrom(payload, response.status);
return parseRuntimeTrustKeyRevealResponse(payload);
}
export async function previewRuntimePublicKeyFingerprint(
publicKey: string,
): Promise<string> {
@@ -739,8 +762,15 @@ export async function revokeRuntimeTrustKey(
workspaceId: string,
runtimeId: string,
request: RevokeRuntimeTrustKeyRequest,
currentFingerprint: string,
confirmation: string,
fetchImpl: typeof fetch = fetch,
): Promise<WorkspaceRuntimeDetail> {
if (!currentFingerprint || confirmation.trim() !== currentFingerprint) {
throw new RuntimeTrustRequestError(
"Enter the current fingerprint exactly before revoking Workspace trust.",
);
}
const response = await fetchImpl(
workspaceApiPath(
workspaceId,
web/workspace/src/lib/workspace/styles/settings.css
+8 -4
View File
@@ -426,7 +426,8 @@
.runtime-public-key,
.runtime-trust-form textarea,
.runtime-trust-form input {
.runtime-trust-form input,
.runtime-revoke-row input {
border: 1px solid var(--line);
border-radius: 0.5rem;
background: var(--bg-raised);
@@ -450,14 +451,16 @@
max-width: 56rem;
}
.runtime-trust-form label {
.runtime-trust-form label,
.runtime-revoke-row label {
color: var(--text-muted);
font-size: 0.78rem;
font-weight: 700;
}
.runtime-trust-form textarea,
.runtime-trust-form input {
.runtime-trust-form input,
.runtime-revoke-row input {
width: 100%;
padding: 0.65rem 0.75rem;
}
@@ -466,7 +469,8 @@
resize: vertical;
}
.runtime-trust-form small {
.runtime-trust-form small,
.runtime-revoke-row small {
color: var(--text-muted);
}
web/workspace/src/routes/w/[workspaceId]/settings/runtimes/[runtimeId]/+page.svelte
+79 -18
View File
@@ -8,6 +8,7 @@
import {
previewRuntimePublicKeyFingerprint,
putRuntimeTrustKey,
revealRuntimeTrustKey,
revokeRuntimeTrustKey,
RuntimeTrustConflictError,
RuntimeTrustRequestError,
@@ -17,10 +18,12 @@
type TrustAction = 'create' | 'replace' | 'reactivate';
let { data }: PageProps = $props();
let revealPublicKey = $state(false);
let showPublicKey = $state(false);
let revealedPublicKey = $state<string | null>(null);
let publicKey = $state('');
let fingerprintConfirmation = $state('');
let busyAction = $state<'save' | 'revoke' | 'copy' | null>(null);
let revokeFingerprintConfirmation = $state('');
let busyAction = $state<'save' | 'revoke' | 'reveal' | 'copy' | null>(null);
let fieldError = $state<string | null>(null);
let requestError = $state<string | null>(null);
let successMessage = $state<string | null>(null);
@@ -125,7 +128,9 @@
await putRuntimeTrustKey(data.workspaceId, data.runtimeId, request);
publicKey = '';
fingerprintConfirmation = '';
revealPublicKey = false;
revokeFingerprintConfirmation = '';
showPublicKey = false;
revealedPublicKey = null;
successMessage = action === 'create'
? 'Workspace trust was created.'
: action === 'replace'
@@ -154,6 +159,13 @@
requestError = 'Only active Workspace trust can be revoked.';
return;
}
if (
!trust.fingerprint ||
revokeFingerprintConfirmation.trim() !== trust.fingerprint
) {
fieldError = 'Enter the current fingerprint exactly before revoking Workspace trust.';
return;
}
fieldError = null;
requestError = null;
@@ -164,10 +176,18 @@
};
try {
await revokeRuntimeTrustKey(data.workspaceId, data.runtimeId, request);
await revokeRuntimeTrustKey(
data.workspaceId,
data.runtimeId,
request,
trust.fingerprint,
revokeFingerprintConfirmation,
);
publicKey = '';
fingerprintConfirmation = '';
revealPublicKey = false;
revokeFingerprintConfirmation = '';
showPublicKey = false;
revealedPublicKey = null;
successMessage = 'Workspace trust was revoked.';
await reloadAuthority();
} catch (error) {
@@ -182,16 +202,40 @@
}
}
async function togglePublicKeyReveal(): Promise<void> {
if (showPublicKey) {
showPublicKey = false;
revealedPublicKey = null;
return;
}
if (busyAction !== null) return;
busyAction = 'reveal';
requestError = null;
successMessage = null;
try {
const response = await revealRuntimeTrustKey(data.workspaceId, data.runtimeId);
revealedPublicKey = response.public_key;
showPublicKey = true;
} catch (error) {
requestError = error instanceof Error ? error.message : 'Public key reveal failed.';
} finally {
busyAction = null;
}
}
async function copyPublicKey(): Promise<void> {
const key = data.runtimeDetail?.trust_key.public_key;
if (!key || busyAction !== null) return;
if (busyAction !== null) return;
busyAction = 'copy';
requestError = null;
successMessage = null;
try {
await navigator.clipboard.writeText(key);
const response = await revealRuntimeTrustKey(data.workspaceId, data.runtimeId);
await navigator.clipboard.writeText(response.public_key);
successMessage = 'Public key copied.';
} catch {
requestError = 'The browser could not copy the public key.';
} catch (error) {
requestError = error instanceof Error
? error.message
: 'The browser could not copy the public key.';
} finally {
busyAction = null;
}
@@ -255,20 +299,23 @@
<section class="runtime-detail-section" aria-labelledby="runtime-trust-heading">
<h2 id="runtime-trust-heading">Workspace trust</h2>
{#if trust.public_key}
{#if trust.status !== 'unconfigured'}
<div class="runtime-public-key-actions">
<button type="button" class="secondary" onclick={() => revealPublicKey = !revealPublicKey}>
{revealPublicKey ? 'Hide public key' : 'Reveal public key'}
<button
type="button"
class="secondary"
disabled={busyAction !== null}
onclick={togglePublicKeyReveal}
>
{busyAction === 'reveal' ? 'Loading…' : showPublicKey ? 'Hide public key' : 'Reveal public key'}
</button>
<button type="button" class="secondary" disabled={busyAction !== null} onclick={copyPublicKey}>
{busyAction === 'copy' ? 'Copying…' : 'Copy public key'}
</button>
</div>
{#if revealPublicKey}
<pre class="runtime-public-key"><code>{trust.public_key}</code></pre>
{#if showPublicKey && revealedPublicKey}
<pre class="runtime-public-key"><code>{revealedPublicKey}</code></pre>
{/if}
{:else if trust.status !== 'unconfigured'}
<p class="section-state">The public key was not included in this authorized response.</p>
{/if}
<form class="runtime-trust-form" onsubmit={saveTrustKey}>
@@ -324,11 +371,25 @@
<div>
<strong>Revoke Workspace trust</strong>
<p>Workspace trust only; this does not delete the Runtime process, Workers, or Workdirs.</p>
<label>
Confirm current fingerprint
<input
bind:value={revokeFingerprintConfirmation}
autocomplete="off"
spellcheck="false"
disabled={trust.status !== 'active' || busyAction !== null}
/>
<small>Enter <code>{trust.fingerprint ?? 'the current fingerprint'}</code> exactly before revocation.</small>
</label>
</div>
<button
type="button"
class="danger"
disabled={busyAction !== null || trust.status !== 'active'}
disabled={
busyAction !== null ||
trust.status !== 'active' ||
revokeFingerprintConfirmation.trim() !== trust.fingerprint
}
onclick={revokeTrust}
>{busyAction === 'revoke' ? 'Revoking…' : 'Revoke trust'}</button>
</div>
web/workspace/tests/runtime-management-source.test.ts
+2
View File
@@ -110,6 +110,8 @@ Deno.test("Runtime detail keeps trust controls owner-only and conflict-safe", as
"Revoke Workspace trust",
"Workspace trust only; this does not delete the Runtime process, Workers, or Workdirs.",
"RuntimeTrustConflictError",
"revealRuntimeTrustKey",
"revokeFingerprintConfirmation.trim() !== trust.fingerprint",
"await reloadAuthority()",
"busyAction !== null",
"Workdirs",
web/workspace/tests/runtime-management.test.ts
+30 -4
View File
@@ -4,10 +4,12 @@ declare const Deno: {
import {
parseRuntimeTrustConflict,
parseRuntimeTrustKeyRevealResponse,
parseWorkspaceRuntimeDetail,
parseWorkspaceRuntimeList,
previewRuntimePublicKeyFingerprint,
putRuntimeTrustKey,
revokeRuntimeTrustKey,
RuntimeTrustConflictError,
} from "../src/lib/workspace/api/runtime-management.ts";
@@ -62,7 +64,6 @@ function detail() {
endpoint: "https://runtime.example.test",
trust_key: {
status: "active",
public_key: "ssh-ed25519 AAAA-test",
fingerprint: "SHA256:current",
revision: 3,
created_at: "2026-09-01T12:00:00Z",
@@ -162,10 +163,11 @@ Deno.test("Runtime validators reject unsafe revisions and bounded collection ove
});
Deno.test("Runtime detail rejects unbounded strings and incoherent trust state", () => {
const largeKey = structuredClone(detail());
largeKey.trust_key.public_key = "x".repeat(16 * 1024 + 1);
assertThrows(
() => parseWorkspaceRuntimeDetail(largeKey),
() =>
parseRuntimeTrustKeyRevealResponse({
public_key: "x".repeat(16 * 1024 + 1),
}),
"must be at most 16384 UTF-8 bytes",
);
@@ -181,6 +183,30 @@ Deno.test("Runtime detail rejects unbounded strings and incoherent trust state",
);
});
Deno.test("mismatched revoke fingerprint never sends a request", async () => {
let requests = 0;
const fetchImpl: typeof fetch = () => {
requests += 1;
return Promise.reject(new Error("request must not be sent"));
};
let rejected = false;
try {
await revokeRuntimeTrustKey(
"workspace-a",
"runtime-a",
{ expected_revision: 3 },
"sha256:current",
"sha256:different",
fetchImpl,
);
} catch (error) {
rejected = error instanceof Error &&
error.message.includes("current fingerprint exactly");
}
assert(rejected, "mismatched fingerprint should be rejected locally");
assert(requests === 0, "mismatched fingerprint sent a revoke request");
});
Deno.test("Runtime public key preview matches the Server fingerprint contract", async () => {
const fingerprint = await previewRuntimePublicKeyFingerprint(
"yoi-ed25519-pub:v1:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",