k2safe/orbit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: support permanent credentials and overlapping token rotation

Browse Source
This commit is contained in:
k2safe
2026-09-27 11:45:15 +08:00
parent 87aa710013
commit 385a618154
29 changed files with 718 additions and 161 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
internal/storage/mysql/credential_integration_test.go
View File

@@ -150,7 +150,7 @@ func TestIntegrationCredentialCommitFaults(t *testing.T) {
if err := Bootstrap(ctx, db, BootstrapInput{Application: name, Namespace: "default", Environment: "test", Queue: "credential"}, func(v BootstrapResult) error { initial = v; return nil }); err != nil {
t.Fatal(err)
}
op, err := PrepareCredentialOperation(ctx, db, CredentialChangeInput{NamespaceID: initial.NamespaceID, CredentialID: initial.CredentialID, ExpectedRevision: 1, Action: credentialRotateAction, ValidFor: time.Hour, Reason: "commit boundary"})
op, err := PrepareCredentialOperation(ctx, db, CredentialChangeInput{NamespaceID: initial.NamespaceID, CredentialID: initial.CredentialID, ExpectedRevision: 1, Action: credentialRotateAction, ValidFor: time.Hour, GraceFor: time.Hour, Reason: "commit boundary"})
if err != nil {
t.Fatal(err)
}
@@ -175,6 +175,14 @@ func TestIntegrationCredentialCommitFaults(t *testing.T) {
if after {
wantRevision = 2
}
oldToken, _ := auth.Parse(initial.Token)
newToken, _ := auth.Parse(op.Token)
if err := NewTaskStore(db).AuthorizeSubmit(ctx, oldToken); err != nil {
t.Fatal("commit ambiguity invalidated old token", err)
}
if accepted := NewTaskStore(db).AuthorizeSubmit(ctx, newToken) == nil; accepted != after {
t.Fatal("commit boundary accepted wrong generation")
}
if status.Revision != wantRevision {
t.Fatalf("commit %v status revision=%d want=%d", after, status.Revision, wantRevision)
}