mirror of
https://github.com/dohooo/helmor.git
synced 2026-09-22 16:40:02 +08:00
Caspian Zhao
6a80be25b1
The F-B lockout (live-verified in class1 run #2): provision rotated HELMOR_COMPANION_TOKEN via 'secret put' BEFORE deploy/verify, and the desktop only receives the token on the terminal 'deployed' line — so any mid-run failure stranded the Worker on a NEW token the desktop never saw (desktop/Worker/container three-way mismatch, existing teams only). Fix (architect-approved failure matrix in class4-design.md par.2): reuse-or- generate. On a RE-provision the frontend passes the desktop's stored admin token (getTeamAdminToken) -> deploy_team_cloud forwards it to the script as HELMOR_EXISTING_COMPANION_TOKEN (env only, never logged) -> provision reuses it, so 'secret put' writes the value the desktop ALREADY holds. After that point every failure row has desktop == Worker; a pre-existing F-B mismatch even self-heals (the put forces the Worker back to the desktop's value). The step ORDER is deliberately unchanged: rotate-then-put stays for FRESH teams (nothing held -> nothing to lock out; 'wrangler secret put' before the first deploy also auto-creates the draft Worker, a load-bearing behavior both rollouts exercised). F-C's 401 propagation grace and destroy-warm keep their semantics — on the reuse path the propagation window physically disappears (same value), on the fresh path they still do their verified job. Forced rotation remains reachable via Leave team -> Create team (clears the token). resolveAdminToken extracted pure (cloud/scripts/admin-token.ts) with unit tests; the frontend wiring is pinned by team-create-flow tests (red-verified against the unwired call).
43 lines
1.8 KiB
TypeScript
43 lines
1.8 KiB
TypeScript
// Round6 P1-4b: re-provision must not rotate the live companion token.
|
|
//
|
|
// The lockout (F-B, live-verified in class1): provision rotated
|
|
// HELMOR_COMPANION_TOKEN via `secret put` BEFORE deploy/verify, and the
|
|
// desktop only receives the token on the terminal `deployed` line — so any
|
|
// mid-run failure left the Worker on a NEW token the desktop never saw.
|
|
// The fix: when the desktop already holds a companion token (an EXISTING
|
|
// team re-provisioning), reuse it — `secret put` then writes the value the
|
|
// desktop already has, so no step failure can create a desktop≠Worker
|
|
// mismatch (and a pre-existing F-B mismatch self-heals: the put forces the
|
|
// Worker back to the desktop's value). A fresh team (no token held) keeps
|
|
// the rotate-on-provision semantics — with nothing held, there is nothing
|
|
// to lock out.
|
|
|
|
import { describe, expect, it } from "vitest";
|
|
import { resolveAdminToken } from "../scripts/admin-token";
|
|
|
|
const generate = () => "hlm_fresh_generated";
|
|
|
|
describe("resolveAdminToken (P1-4b reuse-or-generate)", () => {
|
|
it("REUSES the desktop's existing token verbatim (no rotation)", () => {
|
|
const decision = resolveAdminToken("hlm_desktop_held", generate);
|
|
expect(decision).toEqual({ token: "hlm_desktop_held", reused: true });
|
|
});
|
|
|
|
it("trims whitespace around a reused token", () => {
|
|
const decision = resolveAdminToken(" hlm_desktop_held\n", generate);
|
|
expect(decision).toEqual({ token: "hlm_desktop_held", reused: true });
|
|
});
|
|
|
|
it("generates a fresh token when none is provided (fresh team → rotate)", () => {
|
|
expect(resolveAdminToken(undefined, generate)).toEqual({
|
|
token: "hlm_fresh_generated",
|
|
reused: false,
|
|
});
|
|
});
|
|
|
|
it("treats an empty/whitespace-only value as absent", () => {
|
|
expect(resolveAdminToken("", generate).reused).toBe(false);
|
|
expect(resolveAdminToken(" \n", generate).reused).toBe(false);
|
|
});
|
|
});
|