Complete platform management workflows

platform/service/control_test.go

@@ -134,6 +134,49 @@ func TestCoreServiceRejectsInvalidRunControlHello(t *testing.T) {
 	}
 }
 
+func TestCoreServiceRunHelloRejectsStalePackageKeyAfterReset(t *testing.T) {
+	svc, session, instance := newDistributionTestFixture(t)
+	distribution, err := svc.GenerateRunDistributionForSession(session, domain.RunDistributionGenerateRequest{
+		ServerInstanceID: instance.ID,
+		TargetOS:         "linux",
+		TargetArch:       "amd64",
+		IdempotencyKey:   "idem-control-auth",
+	})
+	if err != nil {
+		t.Fatalf("generate run distribution: %v", err)
+	}
+	pkg := readGeneratedPackageConfig(t, svc, session, distribution.ArtifactID)
+	hello := validRunControlHello()
+	hello.RunEndpointID = instance.RunEndpointID
+	hello.RegistrationToken = pkg.AuthKey
+	hello.ServerInstanceID = instance.ID
+	hello.PluginID = instance.PluginID
+	hello.ComponentKind = domain.DistributionComponentRun
+	hello.KeyGeneration = pkg.KeyGeneration
+
+	result, err := svc.RegisterRunHello(hello)
+	if err != nil {
+		t.Fatalf("register current package hello: %v", err)
+	}
+	if !result.Accepted || result.SessionToken == "" {
+		t.Fatalf("expected current package hello to be accepted, got %+v", result)
+	}
+
+	if _, err := svc.ResetComponentKeyForSession(session, domain.ComponentKeyResetRequest{
+		ServerInstanceID: instance.ID,
+		ComponentKind:    domain.DistributionComponentRun,
+	}); err != nil {
+		t.Fatalf("reset run key: %v", err)
+	}
+	result, err = svc.RegisterRunHello(hello)
+	if err != nil {
+		t.Fatalf("register stale package hello: %v", err)
+	}
+	if result.Accepted || result.SessionToken != "" {
+		t.Fatalf("expected stale package hello to be rejected, got %+v", result)
+	}
+}
+
 func TestCoreServiceRequestsCapabilityRefreshOnFingerprintDrift(t *testing.T) {
 	svc := newTestCoreService()
 	hello, err := svc.RegisterRunHello(validRunControlHello())