Harden worker federation and operator UI

internal/federation/federation_test.go

@@ -1,6 +1,8 @@
 package federation
 
 import (
+	"os"
+	"path/filepath"
 	"testing"
 	"time"
 )
@@ -27,6 +29,68 @@ func TestCursorIsMonotonicAndAuthenticationIsRequired(t *testing.T) {
 	}
 }
 
+func TestPendingApprovalSurvivesRegistryRestart(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "federation-state.json")
+	r := &Registry{StatePath: path}
+	if err := r.Load(); err != nil {
+		t.Fatal(err)
+	}
+	if err := r.Register(Worker{ID: "w", Token: "t"}, ""); err != nil {
+		t.Fatal(err)
+	}
+	capture, err := r.PutCapture("w", Capture{TaskID: "task", PaneID: "pane", Text: "Allow command?"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	queued, err := r.Queue("w", Command{TaskID: "task", Kind: "grant_approval", PaneID: "pane", CaptureRevision: capture.Revision})
+	if err != nil {
+		t.Fatal(err)
+	}
+	info, err := os.Stat(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if info.Mode().Perm() != 0600 {
+		t.Fatalf("federation state permissions = %o, want 0600", info.Mode().Perm())
+	}
+
+	restarted := &Registry{StatePath: path}
+	if err := restarted.Load(); err != nil {
+		t.Fatal(err)
+	}
+	if err := restarted.Register(Worker{ID: "w", Token: "intruder"}, ""); err != ErrUnauthorized {
+		t.Fatalf("recovered worker identity was hijackable: %v", err)
+	}
+	// A restart does not mark the worker online; it must prove its retained
+	// identity by registering again before recovered controls become available.
+	if err := restarted.Register(Worker{ID: "w", Token: "t"}, ""); err != nil {
+		t.Fatal(err)
+	}
+	gotCapture, ok := restarted.Capture("w", "task")
+	if !ok || gotCapture.Revision != capture.Revision || gotCapture.Text != capture.Text {
+		t.Fatalf("capture after restart = %#v, present=%v", gotCapture, ok)
+	}
+	commands, err := restarted.Commands("w")
+	if err != nil || len(commands) != 1 || commands[0].ID != queued.ID {
+		t.Fatalf("commands after restart = %#v, err=%v", commands, err)
+	}
+	if err := restarted.CompleteCommand("w", queued.ID, "acknowledged", ""); err != nil {
+		t.Fatal(err)
+	}
+
+	again := &Registry{StatePath: path}
+	if err := again.Load(); err != nil {
+		t.Fatal(err)
+	}
+	if err := again.Register(Worker{ID: "w", Token: "t"}, ""); err != nil {
+		t.Fatal(err)
+	}
+	commands, err = again.Commands("w")
+	if err != nil || len(commands) != 0 {
+		t.Fatalf("resolved command recovered as pending: %#v, err=%v", commands, err)
+	}
+}
+
 func TestRegisterRequiresAdmitTokenAndOwnToken(t *testing.T) {
 	r := &Registry{AdmitToken: "admit-secret"}
 	if err := r.Register(Worker{ID: "workpc", Token: "secret"}, "wrong"); err != ErrUnauthorized {
@@ -76,6 +140,29 @@ func TestOfflineHookRunsOnceOnTransition(t *testing.T) {
 	}
 }
 
+func TestHeartbeatProjectsWorkerOwnedHealth(t *testing.T) {
+	r := &Registry{}
+	if err := r.Register(Worker{ID: "workpc-opencode", Token: "secret"}, ""); err != nil {
+		t.Fatal(err)
+	}
+	checked := time.Now().UTC().Round(0)
+	errAt := checked.Add(-time.Minute)
+	if err := r.Heartbeat("workpc-opencode", WorkerHealth{
+		HerdrStatus: "unreachable", CheckedAt: checked, ActiveTask: "task-1", ActivePane: "pane-1",
+		LastError: "local herdr: connection refused", ErrorAt: errAt,
+	}); err != nil {
+		t.Fatal(err)
+	}
+	workers := r.Snapshot()
+	if len(workers) != 1 {
+		t.Fatalf("workers=%#v", workers)
+	}
+	h := workers[0].Health
+	if h.HerdrStatus != "unreachable" || h.ActiveTask != "task-1" || h.ActivePane != "pane-1" || h.LastError == "" || !h.CheckedAt.Equal(checked) || !h.ErrorAt.Equal(errAt) {
+		t.Fatalf("health=%#v", h)
+	}
+}
+
 func TestCaptureRevisionAndCommandQueue(t *testing.T) {
 	r := &Registry{}
 	if err := r.Register(Worker{ID: "w", Token: "t"}, ""); err != nil {