workdir: add authenticated runtime session transport

2026-08-03 23:37:15 +09:00
parent 05e8b00bf0
commit e5f0c4168f
10 changed files with 1220 additions and 5 deletions
@@ -360,6 +360,51 @@ impl Runtime {
        self.annotate_working_directory_status(status)
    }

+    /// Open a fresh Workdir operation session after proving that the persisted
+    /// materialization is assigned to a Worker in the authorized workspace.
+    pub fn open_workdir_session_scoped(
+        &self,
+        scope: &RuntimeWorkspaceScope,
+        working_directory_id: &str,
+        owner_worker_ref: Option<&WorkerRef>,
+    ) -> Result<workdir::WorkdirSessionHandle, RuntimeError> {
+        let backend = {
+            let mut state = self.lock()?;
+            state.ensure_running()?;
+            state.ensure_workspace_owner(scope, false)?;
+
+            let owns_workdir = |worker: &WorkerRecord| {
+                worker.belongs_to_workspace(&scope.workspace_id)
+                    && worker.working_directory.as_ref().is_some_and(|status| {
+                        status.summary.working_directory_id == working_directory_id
+                    })
+            };
+            let authorized = match owner_worker_ref {
+                Some(worker_ref) => state
+                    .workers
+                    .get(&worker_ref.worker_id)
+                    .is_some_and(owns_workdir),
+                None => state.workers.values().any(owns_workdir),
+            };
+            if !authorized {
+                return Err(RuntimeError::WorkingDirectory(
+                    crate::working_directory::WorkingDirectoryDiagnostic::rejected(
+                        "working_directory_not_found",
+                        "working directory was not found in the authorized workspace",
+                    ),
+                ));
+            }
+            state.execution_backend.clone().ok_or_else(|| {
+                RuntimeError::ExecutionBackendUnavailable {
+                    message: "opening a Workdir session requires an execution backend".to_string(),
+                }
+            })?
+        };
+        backend
+            .open_workdir_session(working_directory_id)
+            .map_err(RuntimeError::WorkingDirectory)
+    }
+
    /// Cleanup a Runtime-owned working directory.
    pub fn cleanup_working_directory(
        &self,