kami/orchestra
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

feat(federation): admission control on worker registration (S10)

Browse Source 
Register() previously trusted a self-declared id and self-chosen token
from any caller, and let a second caller silently hijack an existing
worker id by re-registering it with a different token. Adds an optional
pre-shared AdmitToken (ORCHESTRA_FEDERATION_ADMIT_TOKEN) and requires a
same-id re-registration to present the existing worker's own token.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W1rkJ2hBMybnJctPbcy4tT
This commit is contained in:
kami
2026-07-27 23:34:02 +04:00
parent fab9225a78
commit 8b4955a687
5 changed files with 85 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/federation/federation_test.go
+23 -2
View File
@@ -7,7 +7,7 @@ import (
func TestCursorIsMonotonicAndAuthenticationIsRequired(t *testing.T) {
r := &Registry{}
if err := r.Register(Worker{ID: "workpc", Token: "secret"}); err != nil {
if err := r.Register(Worker{ID: "workpc", Token: "secret"}, ""); err != nil {
t.Fatal(err)
}
if err := r.Authenticate("workpc", "wrong"); err != ErrUnauthorized {
@@ -27,10 +27,31 @@ func TestCursorIsMonotonicAndAuthenticationIsRequired(t *testing.T) {
}
}
func TestRegisterRequiresAdmitTokenAndOwnToken(t *testing.T) {
r := &Registry{AdmitToken: "admit-secret"}
if err := r.Register(Worker{ID: "workpc", Token: "secret"}, "wrong"); err != ErrUnauthorized {
t.Fatalf("wrong admit token: got %v", err)
}
if err := r.Register(Worker{ID: "workpc", Token: "secret"}, "admit-secret"); err != nil {
t.Fatal(err)
}
// Re-registering the same id with a different token is a hijack
// attempt (S10), not a legitimate re-registration, and must be refused
// even with a valid admit token.
if err := r.Register(Worker{ID: "workpc", Token: "different"}, "admit-secret"); err != ErrUnauthorized {
t.Fatalf("hijack with different token: got %v", err)
}
// The same worker re-registering with its own token (e.g. after a
// restart) must still succeed.
if err := r.Register(Worker{ID: "workpc", Token: "secret"}, "admit-secret"); err != nil {
t.Fatalf("legitimate re-registration: %v", err)
}
}
func TestOfflineHookRunsOnceOnTransition(t *testing.T) {
called := make(chan Worker, 1)
r := &Registry{TTL: time.Millisecond, OnOffline: func(w Worker) { called <- w }}
if err := r.Register(Worker{ID: "workpc"}); err != nil {
if err := r.Register(Worker{ID: "workpc", Token: "secret"}, ""); err != nil {
t.Fatal(err)
}
r.mu.Lock()