auth: bootstrap legacy workspace ownership
This commit is contained in:
@@ -5150,8 +5150,9 @@ async fn post_passkey_registration_complete(
|
||||
)
|
||||
})?;
|
||||
let credential_id = passkey_credential_id(&passkey)?;
|
||||
api.store
|
||||
.upsert_passkey_credential(&PasskeyCredentialRecord {
|
||||
let registered_at = crate::auth::now_rfc3339();
|
||||
api.store.upsert_passkey_and_claim_legacy_workspace_owner(
|
||||
&PasskeyCredentialRecord {
|
||||
credential_id,
|
||||
user_id: user.user_id.clone(),
|
||||
public_key_cose: serde_json::to_string(&passkey).map_err(|error| {
|
||||
@@ -5159,9 +5160,13 @@ async fn post_passkey_registration_complete(
|
||||
})?,
|
||||
transports_json: None,
|
||||
sign_count: 0,
|
||||
created_at: crate::auth::now_rfc3339(),
|
||||
created_at: registered_at.clone(),
|
||||
last_used_at: None,
|
||||
})?;
|
||||
},
|
||||
api.workspace_id(),
|
||||
&user.account_id,
|
||||
®istered_at,
|
||||
)?;
|
||||
issue_browser_session_response(&api, user)
|
||||
}
|
||||
|
||||
|
||||
@@ -504,6 +504,16 @@ pub trait ControlPlaneStore: Send + Sync {
|
||||
fn get_user_by_handle(&self, handle: &str) -> Result<Option<UserRecord>>;
|
||||
fn any_user(&self) -> Result<Option<UserRecord>>;
|
||||
fn upsert_passkey_credential(&self, record: &PasskeyCredentialRecord) -> Result<()>;
|
||||
/// Temporary migration bridge for legacy local databases that predate
|
||||
/// Workspace ownership. The first verified passkey atomically claims an
|
||||
/// ownerless Workspace; remove after supported databases have owners.
|
||||
fn upsert_passkey_and_claim_legacy_workspace_owner(
|
||||
&self,
|
||||
record: &PasskeyCredentialRecord,
|
||||
workspace_id: &str,
|
||||
account_id: &str,
|
||||
updated_at: &str,
|
||||
) -> Result<bool>;
|
||||
fn get_passkey_credential(
|
||||
&self,
|
||||
credential_id: &str,
|
||||
@@ -1453,6 +1463,52 @@ impl ControlPlaneStore for SqliteWorkspaceStore {
|
||||
})
|
||||
}
|
||||
|
||||
fn upsert_passkey_and_claim_legacy_workspace_owner(
|
||||
&self,
|
||||
record: &PasskeyCredentialRecord,
|
||||
workspace_id: &str,
|
||||
account_id: &str,
|
||||
updated_at: &str,
|
||||
) -> Result<bool> {
|
||||
self.with_conn(|conn| {
|
||||
let tx = conn.unchecked_transaction()?;
|
||||
let verified_passkeys = tx.query_row(
|
||||
"SELECT COUNT(*) FROM passkey_credentials",
|
||||
[],
|
||||
|row| row.get::<_, i64>(0),
|
||||
)?;
|
||||
tx.execute(
|
||||
r#"INSERT INTO passkey_credentials (credential_id, user_id, public_key_cose, transports_json, sign_count, created_at, last_used_at)
|
||||
VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7)
|
||||
ON CONFLICT(credential_id) DO UPDATE SET
|
||||
public_key_cose = excluded.public_key_cose,
|
||||
transports_json = excluded.transports_json,
|
||||
sign_count = excluded.sign_count,
|
||||
last_used_at = excluded.last_used_at"#,
|
||||
params![record.credential_id, record.user_id, record.public_key_cose, record.transports_json, record.sign_count, record.created_at, record.last_used_at],
|
||||
)?;
|
||||
let claimed = if verified_passkeys == 0 {
|
||||
tx.execute(
|
||||
r#"UPDATE workspaces
|
||||
SET owner_account_id = ?2, updated_at = ?3
|
||||
WHERE workspace_id = ?1
|
||||
AND owner_account_id IS NULL
|
||||
AND EXISTS (
|
||||
SELECT 1 FROM users
|
||||
WHERE user_id = ?4
|
||||
AND account_id = ?2
|
||||
AND state = 'active'
|
||||
)"#,
|
||||
params![workspace_id, account_id, updated_at, record.user_id],
|
||||
)? == 1
|
||||
} else {
|
||||
false
|
||||
};
|
||||
tx.commit()?;
|
||||
Ok(claimed)
|
||||
})
|
||||
}
|
||||
|
||||
fn get_passkey_credential(
|
||||
&self,
|
||||
credential_id: &str,
|
||||
@@ -5249,6 +5305,171 @@ CREATE TABLE ticket_assignment_operations (
|
||||
);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn first_verified_passkey_claims_legacy_ownerless_workspace_once() {
|
||||
let store = SqliteWorkspaceStore::in_memory().unwrap();
|
||||
let now = "2026-07-30T00:00:00Z".to_string();
|
||||
store
|
||||
.upsert_workspace(&WorkspaceRecord {
|
||||
workspace_id: "legacy-local".to_string(),
|
||||
owner_account_id: None,
|
||||
display_name: "Legacy local".to_string(),
|
||||
state: "active".to_string(),
|
||||
created_at: now.clone(),
|
||||
updated_at: now.clone(),
|
||||
})
|
||||
.await
|
||||
.unwrap();
|
||||
|
||||
for suffix in ["first", "second"] {
|
||||
store
|
||||
.upsert_account(&AccountRecord {
|
||||
account_id: format!("account-{suffix}"),
|
||||
kind: "user".to_string(),
|
||||
handle: suffix.to_string(),
|
||||
display_name: suffix.to_string(),
|
||||
created_at: now.clone(),
|
||||
updated_at: now.clone(),
|
||||
})
|
||||
.unwrap();
|
||||
store
|
||||
.upsert_user(&UserRecord {
|
||||
user_id: format!("user-{suffix}"),
|
||||
account_id: format!("account-{suffix}"),
|
||||
handle: suffix.to_string(),
|
||||
display_name: suffix.to_string(),
|
||||
created_at: now.clone(),
|
||||
updated_at: now.clone(),
|
||||
})
|
||||
.unwrap();
|
||||
}
|
||||
|
||||
let first = PasskeyCredentialRecord {
|
||||
credential_id: "credential-first".to_string(),
|
||||
user_id: "user-first".to_string(),
|
||||
public_key_cose: "public-key-first".to_string(),
|
||||
transports_json: None,
|
||||
sign_count: 0,
|
||||
created_at: now.clone(),
|
||||
last_used_at: None,
|
||||
};
|
||||
assert!(
|
||||
store
|
||||
.upsert_passkey_and_claim_legacy_workspace_owner(
|
||||
&first,
|
||||
"legacy-local",
|
||||
"account-first",
|
||||
&now,
|
||||
)
|
||||
.unwrap()
|
||||
);
|
||||
|
||||
let second = PasskeyCredentialRecord {
|
||||
credential_id: "credential-second".to_string(),
|
||||
user_id: "user-second".to_string(),
|
||||
public_key_cose: "public-key-second".to_string(),
|
||||
transports_json: None,
|
||||
sign_count: 0,
|
||||
created_at: now.clone(),
|
||||
last_used_at: None,
|
||||
};
|
||||
assert!(
|
||||
!store
|
||||
.upsert_passkey_and_claim_legacy_workspace_owner(
|
||||
&second,
|
||||
"legacy-local",
|
||||
"account-second",
|
||||
&now,
|
||||
)
|
||||
.unwrap()
|
||||
);
|
||||
assert_eq!(
|
||||
store
|
||||
.get_workspace("legacy-local")
|
||||
.await
|
||||
.unwrap()
|
||||
.unwrap()
|
||||
.owner_account_id
|
||||
.as_deref(),
|
||||
Some("account-first")
|
||||
);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn first_verified_passkey_preserves_existing_workspace_owner() {
|
||||
let store = SqliteWorkspaceStore::in_memory().unwrap();
|
||||
let now = "2026-07-30T00:00:00Z".to_string();
|
||||
store
|
||||
.upsert_account(&AccountRecord {
|
||||
account_id: "account-owner".to_string(),
|
||||
kind: "user".to_string(),
|
||||
handle: "owner".to_string(),
|
||||
display_name: "Owner".to_string(),
|
||||
created_at: now.clone(),
|
||||
updated_at: now.clone(),
|
||||
})
|
||||
.unwrap();
|
||||
store
|
||||
.upsert_workspace(&WorkspaceRecord {
|
||||
workspace_id: "owned".to_string(),
|
||||
owner_account_id: Some("account-owner".to_string()),
|
||||
display_name: "Owned".to_string(),
|
||||
state: "active".to_string(),
|
||||
created_at: now.clone(),
|
||||
updated_at: now.clone(),
|
||||
})
|
||||
.await
|
||||
.unwrap();
|
||||
store
|
||||
.upsert_account(&AccountRecord {
|
||||
account_id: "account-first".to_string(),
|
||||
kind: "user".to_string(),
|
||||
handle: "first".to_string(),
|
||||
display_name: "First".to_string(),
|
||||
created_at: now.clone(),
|
||||
updated_at: now.clone(),
|
||||
})
|
||||
.unwrap();
|
||||
store
|
||||
.upsert_user(&UserRecord {
|
||||
user_id: "user-first".to_string(),
|
||||
account_id: "account-first".to_string(),
|
||||
handle: "first".to_string(),
|
||||
display_name: "First".to_string(),
|
||||
created_at: now.clone(),
|
||||
updated_at: now.clone(),
|
||||
})
|
||||
.unwrap();
|
||||
assert!(
|
||||
!store
|
||||
.upsert_passkey_and_claim_legacy_workspace_owner(
|
||||
&PasskeyCredentialRecord {
|
||||
credential_id: "credential-first".to_string(),
|
||||
user_id: "user-first".to_string(),
|
||||
public_key_cose: "public-key-first".to_string(),
|
||||
transports_json: None,
|
||||
sign_count: 0,
|
||||
created_at: now.clone(),
|
||||
last_used_at: None,
|
||||
},
|
||||
"owned",
|
||||
"account-first",
|
||||
&now,
|
||||
)
|
||||
.unwrap()
|
||||
);
|
||||
assert_eq!(
|
||||
store
|
||||
.get_workspace("owned")
|
||||
.await
|
||||
.unwrap()
|
||||
.unwrap()
|
||||
.owner_account_id
|
||||
.as_deref(),
|
||||
Some("account-owner")
|
||||
);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn account_and_login_records_round_trip() {
|
||||
let store = SqliteWorkspaceStore::in_memory().unwrap();
|
||||
|
||||
Reference in New Issue
Block a user