Hare/yoi
1
1
Fork 0
Code Actions Packages Releases Activity

auth: bootstrap legacy workspace ownership

Browse Source
This commit is contained in:
Hare
2026-08-02 00:26:28 +09:00
parent 0f9f06048a
commit e530150e43
6 changed files with 330 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/workspace-server/src/server.rs
+9 -4
View File
@@ -5150,8 +5150,9 @@ async fn post_passkey_registration_complete(
)
})?;
let credential_id = passkey_credential_id(&passkey)?;
api.store
.upsert_passkey_credential(&PasskeyCredentialRecord {
let registered_at = crate::auth::now_rfc3339();
api.store.upsert_passkey_and_claim_legacy_workspace_owner(
&PasskeyCredentialRecord {
credential_id,
user_id: user.user_id.clone(),
public_key_cose: serde_json::to_string(&passkey).map_err(|error| {
@@ -5159,9 +5160,13 @@ async fn post_passkey_registration_complete(
})?,
transports_json: None,
sign_count: 0,
created_at: crate::auth::now_rfc3339(),
created_at: registered_at.clone(),
last_used_at: None,
})?;
},
api.workspace_id(),
&user.account_id,
&registered_at,
)?;
issue_browser_session_response(&api, user)
}
crates/workspace-server/src/store.rs
+221
View File
@@ -504,6 +504,16 @@ pub trait ControlPlaneStore: Send + Sync {
fn get_user_by_handle(&self, handle: &str) -> Result<Option<UserRecord>>;
fn any_user(&self) -> Result<Option<UserRecord>>;
fn upsert_passkey_credential(&self, record: &PasskeyCredentialRecord) -> Result<()>;
/// Temporary migration bridge for legacy local databases that predate
/// Workspace ownership. The first verified passkey atomically claims an
/// ownerless Workspace; remove after supported databases have owners.
fn upsert_passkey_and_claim_legacy_workspace_owner(
&self,
record: &PasskeyCredentialRecord,
workspace_id: &str,
account_id: &str,
updated_at: &str,
) -> Result<bool>;
fn get_passkey_credential(
&self,
credential_id: &str,
@@ -1453,6 +1463,52 @@ impl ControlPlaneStore for SqliteWorkspaceStore {
})
}
fn upsert_passkey_and_claim_legacy_workspace_owner(
&self,
record: &PasskeyCredentialRecord,
workspace_id: &str,
account_id: &str,
updated_at: &str,
) -> Result<bool> {
self.with_conn(|conn| {
let tx = conn.unchecked_transaction()?;
let verified_passkeys = tx.query_row(
"SELECT COUNT(*) FROM passkey_credentials",
[],
|row| row.get::<_, i64>(0),
)?;
tx.execute(
r#"INSERT INTO passkey_credentials (credential_id, user_id, public_key_cose, transports_json, sign_count, created_at, last_used_at)
VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7)
ON CONFLICT(credential_id) DO UPDATE SET
public_key_cose = excluded.public_key_cose,
transports_json = excluded.transports_json,
sign_count = excluded.sign_count,
last_used_at = excluded.last_used_at"#,
params![record.credential_id, record.user_id, record.public_key_cose, record.transports_json, record.sign_count, record.created_at, record.last_used_at],
)?;
let claimed = if verified_passkeys == 0 {
tx.execute(
r#"UPDATE workspaces
SET owner_account_id = ?2, updated_at = ?3
WHERE workspace_id = ?1
AND owner_account_id IS NULL
AND EXISTS (
SELECT 1 FROM users
WHERE user_id = ?4
AND account_id = ?2
AND state = 'active'
)"#,
params![workspace_id, account_id, updated_at, record.user_id],
)? == 1
} else {
false
};
tx.commit()?;
Ok(claimed)
})
}
fn get_passkey_credential(
&self,
credential_id: &str,
@@ -5249,6 +5305,171 @@ CREATE TABLE ticket_assignment_operations (
);
}
#[tokio::test]
async fn first_verified_passkey_claims_legacy_ownerless_workspace_once() {
let store = SqliteWorkspaceStore::in_memory().unwrap();
let now = "2026-07-30T00:00:00Z".to_string();
store
.upsert_workspace(&WorkspaceRecord {
workspace_id: "legacy-local".to_string(),
owner_account_id: None,
display_name: "Legacy local".to_string(),
state: "active".to_string(),
created_at: now.clone(),
updated_at: now.clone(),
})
.await
.unwrap();
for suffix in ["first", "second"] {
store
.upsert_account(&AccountRecord {
account_id: format!("account-{suffix}"),
kind: "user".to_string(),
handle: suffix.to_string(),
display_name: suffix.to_string(),
created_at: now.clone(),
updated_at: now.clone(),
})
.unwrap();
store
.upsert_user(&UserRecord {
user_id: format!("user-{suffix}"),
account_id: format!("account-{suffix}"),
handle: suffix.to_string(),
display_name: suffix.to_string(),
created_at: now.clone(),
updated_at: now.clone(),
})
.unwrap();
}
let first = PasskeyCredentialRecord {
credential_id: "credential-first".to_string(),
user_id: "user-first".to_string(),
public_key_cose: "public-key-first".to_string(),
transports_json: None,
sign_count: 0,
created_at: now.clone(),
last_used_at: None,
};
assert!(
store
.upsert_passkey_and_claim_legacy_workspace_owner(
&first,
"legacy-local",
"account-first",
&now,
)
.unwrap()
);
let second = PasskeyCredentialRecord {
credential_id: "credential-second".to_string(),
user_id: "user-second".to_string(),
public_key_cose: "public-key-second".to_string(),
transports_json: None,
sign_count: 0,
created_at: now.clone(),
last_used_at: None,
};
assert!(
!store
.upsert_passkey_and_claim_legacy_workspace_owner(
&second,
"legacy-local",
"account-second",
&now,
)
.unwrap()
);
assert_eq!(
store
.get_workspace("legacy-local")
.await
.unwrap()
.unwrap()
.owner_account_id
.as_deref(),
Some("account-first")
);
}
#[tokio::test]
async fn first_verified_passkey_preserves_existing_workspace_owner() {
let store = SqliteWorkspaceStore::in_memory().unwrap();
let now = "2026-07-30T00:00:00Z".to_string();
store
.upsert_account(&AccountRecord {
account_id: "account-owner".to_string(),
kind: "user".to_string(),
handle: "owner".to_string(),
display_name: "Owner".to_string(),
created_at: now.clone(),
updated_at: now.clone(),
})
.unwrap();
store
.upsert_workspace(&WorkspaceRecord {
workspace_id: "owned".to_string(),
owner_account_id: Some("account-owner".to_string()),
display_name: "Owned".to_string(),
state: "active".to_string(),
created_at: now.clone(),
updated_at: now.clone(),
})
.await
.unwrap();
store
.upsert_account(&AccountRecord {
account_id: "account-first".to_string(),
kind: "user".to_string(),
handle: "first".to_string(),
display_name: "First".to_string(),
created_at: now.clone(),
updated_at: now.clone(),
})
.unwrap();
store
.upsert_user(&UserRecord {
user_id: "user-first".to_string(),
account_id: "account-first".to_string(),
handle: "first".to_string(),
display_name: "First".to_string(),
created_at: now.clone(),
updated_at: now.clone(),
})
.unwrap();
assert!(
!store
.upsert_passkey_and_claim_legacy_workspace_owner(
&PasskeyCredentialRecord {
credential_id: "credential-first".to_string(),
user_id: "user-first".to_string(),
public_key_cose: "public-key-first".to_string(),
transports_json: None,
sign_count: 0,
created_at: now.clone(),
last_used_at: None,
},
"owned",
"account-first",
&now,
)
.unwrap()
);
assert_eq!(
store
.get_workspace("owned")
.await
.unwrap()
.unwrap()
.owner_account_id
.as_deref(),
Some("account-owner")
);
}
#[tokio::test]
async fn account_and_login_records_round_trip() {
let store = SqliteWorkspaceStore::in_memory().unwrap();
docs/report/2026-07-30-restored-worker-workspace-credential-stale.md
+28
View File
@@ -0,0 +1,28 @@
# Restored Worker retained unusable Workspace credential after Backend restart
## Observed
After restarting the Runtime and Server, Worker 30 restored and continued executing normal turns, but every typed Ticket operation failed with:
```text
Worker Workspace authentication failed: missing Runtime Workspace credential
```
The Server control-plane DB contained a current active `worker_workspace_credentials` row for the same Workspace, Runtime, and Worker identity, while the restored Worker/tool request did not authenticate with it. The failure prevented the required ticket-first workflow for an auth/storage regression even though the Worker itself remained live.
## Impact
- Restore can appear healthy because model turns still execute while Workspace-authority tools are unusable.
- A Worker cannot report or ticket the restore regression through the intended typed authority.
- The failure is easy to misattribute to the Browser multiplexer; in this incident Browser authentication/bootstrap was a separate issue.
## Suggested investigation
Trace the credential lifecycle across Backend restart and Runtime Worker restore:
1. whether Backend rotates or recreates the credential record;
2. whether restored Worker execution receives the current plaintext credential rather than retaining an old environment/config bundle;
3. whether credential binding should remain stable across Backend restart or be explicitly refreshed before marking the Worker restored;
4. whether restore health should include a bounded Workspace API authentication probe.
Do not treat a current DB credential row alone as proof that the restored Worker possesses it.
web/workspace/src/lib/workspace/console/worker-console.ui.test.ts
+8
View File
@@ -731,4 +731,12 @@ Deno.test("Workspace Worker list and Console share the multiplexed connection",
multiplexer.includes("frame: 'worker_protocol'"),
"Sidebar and Console should share one Workspace multiplexer and route Worker methods through a subscription lane",
);
assert(
multiplexer.includes("loadWhoami") &&
multiplexer.includes("actor === null") &&
multiplexer.includes("AUTH_RECHECK_DELAY_MS") &&
multiplexer.includes("Register or sign in on the Account page") &&
consolePage.includes("workspace_subscription_auth_required"),
"Workspace multiplexer should replace a tight unauthenticated WebSocket loop with an actionable auth status and bounded recheck",
);
});
web/workspace/src/lib/workspace/multiplexer.ts
+43 -14
View File
@@ -6,6 +6,7 @@ import type {
SubscriptionId,
} from '$lib/generated/protocol';
import { workspaceApiPath } from '$lib/workspace/api/http';
import { loadWhoami } from '$lib/workspace/auth/api';
type Listener = {
onFrame(frame: SubscriptionFrame): void;
@@ -26,6 +27,9 @@ export type WorkspaceMultiplexerSubscription = {
};
const multiplexers = new Map<string, WorkspaceMultiplexer>();
const RECONNECT_DELAY_MS = 500;
const AUTH_RECHECK_DELAY_MS = 5_000;
const AUTH_REQUIRED_MESSAGE = 'Authentication required. Register or sign in on the Account page.';
export function workspaceMultiplexer(workspaceId: string): WorkspaceMultiplexer {
let multiplexer = multiplexers.get(workspaceId);
@@ -89,20 +93,45 @@ export class WorkspaceMultiplexer {
});
socket.addEventListener('message', (event) => this.#receive(String(event.data)));
socket.addEventListener('error', () => socket.close());
socket.addEventListener('close', () => {
if (this.#socket !== socket) return;
this.#socket = null;
this.#requests.clear();
this.#runtimeSubscriptions.clear();
for (const subscription of this.#subscriptions.values()) {
subscription.requestId = null;
subscription.subscriptionId = null;
subscription.listener.onStatus?.('closed', 'Workspace subscription disconnected');
}
if (!this.#closed && this.#subscriptions.size > 0) {
this.#reconnectTimer = setTimeout(() => this.#ensureConnected(), 500);
}
});
socket.addEventListener('close', () => void this.#handleSocketClose(socket));
}
async #handleSocketClose(socket: WebSocket): Promise<void> {
if (this.#socket !== socket) return;
this.#socket = null;
this.#requests.clear();
this.#runtimeSubscriptions.clear();
for (const subscription of this.#subscriptions.values()) {
subscription.requestId = null;
subscription.subscriptionId = null;
}
if (this.#closed || this.#subscriptions.size === 0) return;
let authenticationRequired = false;
try {
authenticationRequired = (await loadWhoami()).actor === null;
} catch {
// A failed auth probe is treated as a transient network/backend failure.
}
if (this.#closed || this.#subscriptions.size === 0 || this.#socket) return;
const message = authenticationRequired
? AUTH_REQUIRED_MESSAGE
: 'Workspace subscription disconnected';
for (const subscription of this.#subscriptions.values()) {
subscription.listener.onStatus?.('closed', message);
}
this.#scheduleReconnect(
authenticationRequired ? AUTH_RECHECK_DELAY_MS : RECONNECT_DELAY_MS,
);
}
#scheduleReconnect(delayMs: number): void {
if (this.#reconnectTimer) clearTimeout(this.#reconnectTimer);
this.#reconnectTimer = setTimeout(() => {
this.#reconnectTimer = null;
this.#ensureConnected();
}, delayMs);
}
#sendSubscribe(subscription: ActiveSubscription): void {
web/workspace/src/routes/w/[workspaceId]/runtimes/[runtimeId]/workers/[workerId]/console/+page.svelte
+21 -3
View File
@@ -564,11 +564,29 @@
];
}
},
onStatus: (status) => {
onStatus: (status, message) => {
if (token !== reloadToken) return;
protocolState = status === "open" ? "connecting" : status;
const authenticationRequired = message?.startsWith("Authentication required") ?? false;
protocolState = authenticationRequired
? "error"
: status === "open"
? "connecting"
: status;
if (authenticationRequired && message) {
streamDiagnostics = [
...streamDiagnostics.filter(
(diagnostic) =>
diagnostic.code !== "workspace_subscription_auth_required",
),
{
code: "workspace_subscription_auth_required",
severity: "error",
message,
},
];
}
if (status === "closed") {
rejectPendingCompletion(new Error("Worker protocol WebSocket closed."));
rejectPendingCompletion(new Error(message ?? "Worker protocol WebSocket closed."));
}
},
},