mirror of
https://github.com/stablyai/orca.git
synced 2026-11-04 02:57:36 +00:00
b80c420054
* feat(pairing): re-pairing the same server keeps its environment The web client minted a new environment id on every runtime-scope pairing link, even for the same server key, so existing terminals kept the old id and failed as ambiguous. A key-matched re-pair now keeps the id (bumping the pairing revision) and pins the server's host descriptor; a same-key server with a different installation gets a new id, and a downgraded server never replaces the pin. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(web): a reply from the replaced pairing never overwrites a same-server re-pair Re-pairing now keeps the environment id, so fence on the pairing revision too: a request captured before the re-pair can neither reopen a client with the replaced token nor save the old pairing back over the new one. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: m4air <m4air@Mac.localdomain> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
57 lines
2.3 KiB
TypeScript
57 lines
2.3 KiB
TypeScript
import { describe, expect, it } from 'vitest'
|
|
import { classifyRuntimeHostRePair } from './runtime-host-pairing-identity'
|
|
|
|
const INSTALL_A = '11111111-1111-4111-8111-111111111111'
|
|
const INSTALL_B = '22222222-2222-4222-8222-222222222222'
|
|
const BIND_1 = 'a'.repeat(43)
|
|
const BIND_2 = 'b'.repeat(43)
|
|
|
|
describe('classifyRuntimeHostRePair', () => {
|
|
it('treats a different host key as a different server, whatever the descriptor says', () => {
|
|
expect(
|
|
classifyRuntimeHostRePair(
|
|
{ publicKeys: ['key-a'], pin: { installationId: INSTALL_A } },
|
|
{ publicKeyB64: 'key-b', hostDescriptor: { installationId: INSTALL_A } }
|
|
)
|
|
).toEqual({ kind: 'different-host' })
|
|
})
|
|
|
|
it('keeps an unpinned server matched by key and pins its first descriptor', () => {
|
|
expect(classifyRuntimeHostRePair({ publicKeys: ['key-a'] }, { publicKeyB64: 'key-a' })).toEqual(
|
|
{ kind: 'same-host', pin: undefined, descriptor: 'unpinned' }
|
|
)
|
|
expect(
|
|
classifyRuntimeHostRePair(
|
|
{ publicKeys: ['key-a'] },
|
|
{ publicKeyB64: 'key-a', hostDescriptor: { installationId: INSTALL_A } }
|
|
)
|
|
).toEqual({ kind: 'same-host', pin: { installationId: INSTALL_A }, descriptor: 'pinned' })
|
|
})
|
|
|
|
it('separates a same-key server whose installation changed', () => {
|
|
expect(
|
|
classifyRuntimeHostRePair(
|
|
{ publicKeys: ['key-a'], pin: { installationId: INSTALL_A } },
|
|
{ publicKeyB64: 'key-a', hostDescriptor: { installationId: INSTALL_B } }
|
|
)
|
|
).toEqual({ kind: 'different-host' })
|
|
})
|
|
|
|
it('keeps a moved or reinstalled server and re-pins its new binding', () => {
|
|
const next = { installationId: INSTALL_A, machineBinding: BIND_2 }
|
|
expect(
|
|
classifyRuntimeHostRePair(
|
|
{ publicKeys: ['key-a'], pin: { installationId: INSTALL_A, machineBinding: BIND_1 } },
|
|
{ publicKeyB64: 'key-a', hostDescriptor: next }
|
|
)
|
|
).toEqual({ kind: 'same-host', pin: next, descriptor: 'moved' })
|
|
})
|
|
|
|
it('never learns from a downgraded server that stopped sending a descriptor', () => {
|
|
const pin = { installationId: INSTALL_A, machineBinding: BIND_1 }
|
|
expect(
|
|
classifyRuntimeHostRePair({ publicKeys: ['key-a'], pin }, { publicKeyB64: 'key-a' })
|
|
).toEqual({ kind: 'same-host', pin, descriptor: 'unverifiable' })
|
|
})
|
|
})
|