test: verify worker rebind after credential rotation

internal/storage/mysql/worker_integration_test.go

@@ -593,6 +593,50 @@ func TestIntegrationWorkerExecution(t *testing.T) {
 			t.Fatal(fmt.Sprint(err))
 		}
 	})
+	t.Run("credential_rotation_requires_worker_session_rebind", func(t *testing.T) {
+		f := newExecutionFixture(t, ctx, db)
+		op, err := PrepareCredentialOperation(ctx, db, CredentialChangeInput{
+			NamespaceID:      f.resources.NamespaceID,
+			CredentialID:     f.resources.CredentialID,
+			ExpectedRevision: 1,
+			Action:           credentialRotateAction,
+			ValidFor:         time.Hour,
+			Reason:           "worker session rotation",
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+		if _, err := ApplyCredentialOperation(ctx, db, op); err != nil {
+			t.Fatal(err)
+		}
+		rotated, err := auth.Parse(op.Token)
+		if err != nil {
+			t.Fatal(err)
+		}
+		_, err = f.a.Capacity(ctx, f.token, f.binding, worker.CapacityInput{Sequence: 1, Capacity: f.hello.Capacity})
+		expectWorkerCode(t, err, "UNAUTHENTICATED")
+
+		newBinding, welcome, err := f.a.Connect(ctx, rotated, f.hello)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if newBinding.SessionID == f.binding.SessionID || welcome.SessionID != newBinding.SessionID {
+			t.Fatal("credential rotation did not create a replacement worker session")
+		}
+		var drained bool
+		var expiredAt time.Time
+		if err := db.QueryRowContext(ctx, `SELECT draining,expires_at FROM pulse_worker_sessions WHERE namespace_id=? AND id=?`, f.resources.NamespaceID, f.binding.SessionID).Scan(&drained, &expiredAt); err != nil {
+			t.Fatal(err)
+		}
+		if !drained || expiredAt.After(time.Now().UTC()) {
+			t.Fatalf("old worker session was not drained and expired: draining=%v expires_at=%s", drained, expiredAt.UTC().Format(time.RFC3339Nano))
+		}
+		_, err = f.a.Capacity(ctx, f.token, f.binding, worker.CapacityInput{Sequence: 1, Capacity: f.hello.Capacity})
+		expectWorkerCode(t, err, "UNAUTHENTICATED")
+		if _, err := f.a.Capacity(ctx, rotated, newBinding, worker.CapacityInput{Sequence: 1, Capacity: f.hello.Capacity}); err != nil {
+			t.Fatal(err)
+		}
+	})
 	t.Run("claim_event_failure_does_not_leave_an_invisible_lease", func(t *testing.T) {
 		f := newExecutionFixture(t, ctx, db)
 		task := f.submit(3)