Harden worker federation and operator UI

internal/authz/authz_test.go

@@ -96,6 +96,41 @@ func TestWebSessionCookieGatesControlPathsOnly(t *testing.T) {
 	}
 }
 
+func TestFederationRequestsUseTheirOwnCredentials(t *testing.T) {
+	tokens := map[Surface]string{Web: "web-secret"}
+	h := HTTPWithSessions(tokens, nil, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusNoContent)
+	}))
+
+	for _, tc := range []struct {
+		name   string
+		method string
+		path   string
+		worker string
+		want   int
+	}{
+		{name: "registration reaches admission handler", method: http.MethodPost, path: "/v1/federation/workers", want: http.StatusNoContent},
+		{name: "worker request reaches worker handler", method: http.MethodGet, path: "/v1/federation/events", worker: "workpc-opencode", want: http.StatusNoContent},
+		{name: "worker task reconciliation reaches worker handler", method: http.MethodGet, path: "/v1/tasks", worker: "workpc-opencode", want: http.StatusNoContent},
+		{name: "worker artifact read reaches worker handler", method: http.MethodGet, path: "/v1/artifacts/ref", worker: "workpc-opencode", want: http.StatusNoContent},
+		{name: "worker artifact upload reaches worker handler", method: http.MethodPost, path: "/v1/artifacts", worker: "workpc-opencode", want: http.StatusNoContent},
+		{name: "unnamed worker request remains web gated", method: http.MethodGet, path: "/v1/federation/events", want: http.StatusUnauthorized},
+		{name: "worker list remains web gated", method: http.MethodGet, path: "/v1/federation/workers", want: http.StatusUnauthorized},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			r := httptest.NewRequest(tc.method, tc.path, nil)
+			if tc.worker != "" {
+				r.Header.Set("X-Orchestra-Worker", tc.worker)
+			}
+			w := httptest.NewRecorder()
+			h.ServeHTTP(w, r)
+			if w.Code != tc.want {
+				t.Fatalf("status = %d, want %d", w.Code, tc.want)
+			}
+		})
+	}
+}
+
 func TestSessionExpires(t *testing.T) {
 	s := &Sessions{TTL: time.Millisecond}
 	v, err := s.Issue()
@@ -110,3 +145,18 @@ func TestSessionExpires(t *testing.T) {
 		t.Fatal("empty session accepted")
 	}
 }
+
+func TestSessionRevoke(t *testing.T) {
+	s := &Sessions{}
+	v, err := s.Issue()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !s.Valid(v) {
+		t.Fatal("fresh session must be valid")
+	}
+	s.Revoke(v)
+	if s.Valid(v) {
+		t.Fatal("revoked session must not be valid")
+	}
+}