Hare/yoi
1
1
Fork 0
Code Actions Packages Releases Activity

fix: align isolated runtime harness with current trust contract

Browse Source 
Keep Workspace trust enrollment and owner-authenticated registration, then verify each Runtime connection with a fresh signed request and match its binding ID. Remove obsolete workspace_trust_id input and cached connection_state assertions.

Validation: cargo test -p yoi-e2e --features e2e --test worker_environment --test auth_passkeys -- --nocapture (2 Runtime harness tests and 1 Passkey product E2E passed); root cargo check.
This commit is contained in:
Hare
2026-10-16 00:35:23 +09:00
parent 18384482f6
commit b744efd104
1 changed files with 20 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/e2e/src/worker_environment.rs
+20 -12
View File
@@ -439,7 +439,14 @@ impl WorkerE2eEnvironment {
false,
)?;
let enrollment: Value = serde_json::from_slice(&enrollment.stdout)?;
let workspace_trust_id = json_string(&enrollment, "/trust_id")?;
if json_string(&enrollment, "/trust_id")?.is_empty()
|| enrollment.get("workspace_id").and_then(Value::as_str) != Some(workspace_id.as_str())
|| enrollment.get("state").and_then(Value::as_str) != Some("active")
{
return Err(HarnessError::Protocol(
"Runtime did not retain active trust for the fixture Workspace".to_string(),
));
}
let mut command = self.isolated_command(&runtime_binary);
command.args([
@@ -468,12 +475,20 @@ impl WorkerE2eEnvironment {
.post(format!("{server_url}/api/w/{workspace_id}/runtimes"))
.json(&serde_json::json!({
"public_bundle": runtime_identity,
"workspace_trust_id": workspace_trust_id,
"display_name": format!("E2E {}", self.runtime_id),
"endpoint": runtime_url
})),
"register Runtime",
)?;
self.assert_connected_and_empty()?;
self.write_metadata("running")?;
Ok(())
}
pub fn assert_connected_and_empty(&self) -> Result<()> {
let server_url = self.required_server_url()?;
let workspace_id = self.required_workspace_id()?;
// connection testは実署名要求。保存済みの接続flagを認証成功の代わりにしない。
let connection = self.request_json(
self.client.post(format!(
"{server_url}/api/w/{workspace_id}/runtimes/{}/connection-tests",
@@ -486,14 +501,7 @@ impl WorkerE2eEnvironment {
"Runtime connection was not compatible: {connection}"
)));
}
self.assert_connected_and_empty()?;
self.write_metadata("running")?;
Ok(())
}
pub fn assert_connected_and_empty(&self) -> Result<()> {
let server_url = self.required_server_url()?;
let workspace_id = self.required_workspace_id()?;
let binding_id = json_string(&connection, "/binding_id")?;
let runtimes = self.request_json(
self.client
.get(format!("{server_url}/api/w/{workspace_id}/runtimes")),
@@ -506,9 +514,9 @@ impl WorkerE2eEnvironment {
items.iter().any(|item| {
item.get("runtime_id").and_then(Value::as_str) == Some(self.runtime_id.as_str())
&& item
.pointer("/management/binding/connection_state")
.pointer("/management/binding/binding_id")
.and_then(Value::as_str)
== Some("verified")
== Some(binding_id.as_str())
})
});
if !connected {