auth: enforce workspace worker credentials over ticket REST

crates/workspace-server/src/store.rs

@@ -650,6 +650,14 @@ pub trait ControlPlaneStore: Send + Sync {
         new_token: &str,
         new_expires_at: &str,
     ) -> Result<Option<WorkerWorkspaceCredentialRecord>>;
+    fn revoke_worker_workspace_credentials_except(
+        &self,
+        workspace_id: &str,
+        runtime_id: &str,
+        worker_id: &str,
+        active_credential_id: &str,
+        revoked_at: &str,
+    ) -> Result<()>;
     fn revoke_worker_workspace_credentials(
         &self,
         workspace_id: &str,
@@ -2338,6 +2346,31 @@ impl ControlPlaneStore for SqliteWorkspaceStore {
         })
     }
 
+    fn revoke_worker_workspace_credentials_except(
+        &self,
+        workspace_id: &str,
+        runtime_id: &str,
+        worker_id: &str,
+        active_credential_id: &str,
+        revoked_at: &str,
+    ) -> Result<()> {
+        self.with_conn(|conn| {
+            conn.execute(
+                r#"UPDATE worker_workspace_credentials SET revoked_at = ?5
+                   WHERE workspace_id = ?1 AND runtime_id = ?2 AND worker_id = ?3
+                     AND credential_id <> ?4 AND revoked_at IS NULL"#,
+                params![
+                    workspace_id,
+                    runtime_id,
+                    worker_id,
+                    active_credential_id,
+                    revoked_at
+                ],
+            )?;
+            Ok(())
+        })
+    }
+
     fn revoke_worker_workspace_credentials(
         &self,
         workspace_id: &str,