Remove legacy client-manager workflows

platform/service/distributions_test.go

@@ -511,24 +511,9 @@ func TestCoreServiceResetRunKeyRevokesOldPackagesAndRequiresRegeneration(t *test
 	}
 }
 
-func TestCoreServiceBuildsClientManagerWithDistinctKeyAndRedactsSensitiveOperations(t *testing.T) {
+func TestCoreServiceRejectsClientManagerDistributionRequests(t *testing.T) {
 	svc, session, instance := newDistributionTestFixture(t)
-	runDistribution, err := svc.GenerateRunDistributionForSession(session, domain.RunDistributionGenerateRequest{
-		ServerInstanceID: instance.ID,
-		TargetOS:         "linux",
-		TargetArch:       "amd64",
-		IdempotencyKey:   "idem-run-for-client",
-	})
-	if err != nil {
-		t.Fatalf("generate run distribution: %v", err)
-	}
-	runDistribution = completeDistributionBuild(t, svc, runDistribution, []byte("compiled run archive"))
-	if _, err := svc.OpenArtifactDownloadForSession(session, domain.ArtifactDownloadReferenceRequest{ArtifactID: runDistribution.ArtifactID}); err != nil {
-		t.Fatalf("open run download: %v", err)
-	}
-	runConfig := readGeneratedPackageConfig(t, svc, session, runDistribution.ArtifactID)
-
-	clientDistribution, err := svc.GenerateClientManagerDistributionForSession(session, domain.ClientManagerBuildRequest{
+	_, err := svc.GenerateClientManagerDistributionForSession(session, domain.ClientManagerBuildRequest{
 		ServerInstanceID: instance.ID,
 		ProfileKey:       "scum-client-manager",
 		TargetOS:         "windows",
@@ -537,62 +522,26 @@ func TestCoreServiceBuildsClientManagerWithDistinctKeyAndRedactsSensitiveOperati
 		SourceRevision:   "main",
 		IdempotencyKey:   "idem-client-manager",
 	})
-	if err != nil {
-		t.Fatalf("generate client-manager distribution: %v", err)
+	if err == nil {
+		t.Fatal("expected client-manager distribution request to be rejected")
 	}
-	clientConfig := readGeneratedPackageConfig(t, svc, session, clientDistribution.ArtifactID)
-	if clientDistribution.KeyGeneration != 1 || clientDistribution.BuildJobID == "" || clientDistribution.Status != domain.DistributionStatusBuilding {
-		t.Fatalf("unexpected client-manager distribution: %+v", clientDistribution)
-	}
-	if clientConfig.AuthKey == runConfig.AuthKey || clientDistribution.SecretRef == runDistribution.SecretRef {
-		t.Fatalf("client-manager must use a distinct key/ref, run=%+v client=%+v", runConfig, clientConfig)
-	}
-	build, err := svc.store.ClientManagerBuildJobs().Get(clientDistribution.BuildJobID)
-	if err != nil {
-		t.Fatalf("get build job: %v", err)
-	}
-	if build.Status != domain.DistributionJobStatusQueued || build.RepositoryURL != "https://github.com/F88888/scum_client.git" || build.SourceRevision != "main" {
-		t.Fatalf("unexpected build job: %+v", build)
-	}
-	clientDistribution = completeClientDistributionBuild(t, svc, clientDistribution, []byte("compiled client archive"))
-	build, err = svc.store.ClientManagerBuildJobs().Get(clientDistribution.BuildJobID)
-	if err != nil || build.Status != domain.DistributionJobStatusSucceeded || build.Checksum == "" {
-		t.Fatalf("expected uploaded client build to project as succeeded, build=%+v err=%v", build, err)
-	}
-
-	_, err = svc.GenerateClientManagerDistributionForSession(session, domain.ClientManagerBuildRequest{
-		ServerInstanceID: instance.ID,
-		ProfileKey:       "scum-client-manager",
-		TargetOS:         "darwin",
-		TargetArch:       "amd64",
-		RepositoryURL:    "https://github.com/F88888/scum_client.git",
-		IdempotencyKey:   "idem-client-manager-denied",
-	})
-	if err == nil || !strings.Contains(err.Error(), "targetOs") {
-		t.Fatalf("expected unsupported target denial, got %v", err)
-	}
-
 	if _, err := svc.ResetComponentKeyForSession(session, domain.ComponentKeyResetRequest{
 		ServerInstanceID: instance.ID,
 		ComponentKind:    domain.DistributionComponentClientManager,
 		ComponentKey:     "scum-client-manager",
-	}); err != nil {
-		t.Fatalf("reset client-manager key: %v", err)
+	}); err == nil || !strings.Contains(err.Error(), "componentKind") {
+		t.Fatalf("expected client-manager key reset to be rejected, got %v", err)
 	}
 	auth, err := svc.AuthenticateComponent(domain.ComponentAuthenticationRequest{
 		ServerInstanceID: instance.ID,
 		ComponentKind:    domain.DistributionComponentClientManager,
 		ComponentKey:     "scum-client-manager",
-		Generation:       clientConfig.KeyGeneration,
-		Key:              clientConfig.AuthKey,
+		Generation:       1,
+		Key:              "legacy-client-manager-key",
 	})
-	if err != nil {
-		t.Fatalf("authenticate old client key: %v", err)
+	if err == nil || auth.Allowed {
+		t.Fatalf("expected client-manager component authentication to be rejected, auth=%+v err=%v", auth, err)
 	}
-	if auth.Allowed {
-		t.Fatalf("expected old client-manager key to be denied after reset, got %+v", auth)
-	}
-
 }
 
 func newDistributionTestFixture(t *testing.T) (*CoreService, string, domain.ServerInstance) {
@@ -602,43 +551,30 @@ func newDistributionTestFixture(t *testing.T) (*CoreService, string, domain.Serv
 	plugin.SupportedOS = []string{"linux", "windows"}
 	plugin.DeclaredPermissions = append(plugin.DeclaredPermissions,
 		"server.run.distribution",
-		"server.client-manager.manage",
 		"server.dependencies.manage",
 	)
 	plugin.RequiredRunCapabilities = append(plugin.RequiredRunCapabilities,
 		domain.JobCapabilityRunSelfUpdate,
-		domain.JobCapabilityDependenciesCheck,
-		domain.JobCapabilityDependenciesInstall,
-		domain.JobCapabilityLogsBackfill,
-		domain.JobCapabilityClientManagerDeploy,
-		domain.JobCapabilityClientManagerControl,
-		domain.JobCapabilityClientManagerUpdate,
-		domain.JobCapabilityClientManagerRollback,
-		domain.JobCapabilityClientManagerUninstall,
+			domain.JobCapabilityDependenciesCheck,
+			domain.JobCapabilityDependenciesInstall,
+			domain.JobCapabilityLogsBackfill,
 	)
 	plugin.BridgeActions = append(plugin.BridgeActions,
 		string(domain.PluginBridgeActionRunDistribution),
-		string(domain.PluginBridgeActionClientManager),
 		string(domain.PluginBridgeActionDependenciesRequest),
 		string(domain.PluginBridgeActionLogsBackfillRequest),
 	)
 	plugin.RuntimeProfiles.DependencyProbes = []domain.RuntimeDependencyProbe{{Key: "java-runtime", Kind: "command.version", TargetKey: "java", Platforms: []string{"linux"}}}
 	plugin.RuntimeProfiles.InstallPlans = []domain.RuntimeInstallPlan{{Key: "java-install", Title: "Install Java", Platforms: []string{"linux"}, Steps: []domain.RuntimeInstallStep{{Type: "package", TargetKey: "java", PackageManager: "apt", PackageName: "openjdk-21-jre"}}}}
 	plugin.RuntimeProfiles.LogSources = []domain.RuntimeLogSource{{Key: "latest", Kind: "file.tail", TargetKey: "logs/latest", StreamKey: "latest-log", CursorKind: "offset", RetentionDays: 30}}
-	plugin.RuntimeProfiles.ClientManagers = []domain.RuntimeClientManagerProfile{{Key: "scum-client-manager", DisplayName: "SCUM Client Manager", Version: "1.0.0", RepositoryURL: "https://github.com/F88888/scum_client.git", RevisionPolicy: "branch", Branch: "main", SupportedTargets: []domain.RuntimeTarget{{OS: "windows", Arch: "amd64"}, {OS: "linux", Arch: "amd64"}}, BuildSystem: "go", EntryRef: "main.go", OutputArtifacts: []string{"scum_client.exe"}, Deployment: domain.RuntimeClientManagerDeployment{Mode: "run-supervised", ExecutableRef: "scum_client.exe", RequiredRunCapabilities: []string{domain.JobCapabilityClientManagerDeploy, domain.JobCapabilityClientManagerControl, domain.JobCapabilityClientManagerUpdate, domain.JobCapabilityClientManagerRollback, domain.JobCapabilityClientManagerUninstall}}, Lifecycle: domain.RuntimeClientManagerLifecycle{Actions: []string{"start", "stop", "restart", "status", "update", "rollback", "uninstall"}, StartupTimeoutSeconds: 60, StopTimeoutSeconds: 30}, Health: domain.RuntimeClientManagerHealth{Mode: "component-heartbeat", IntervalSeconds: 15, DegradedAfterSeconds: 45, OfflineAfterSeconds: 120, RequiredCapabilities: []string{"component.register", "component.heartbeat", "component.health"}}, Compatibility: domain.RuntimeClientManagerCompatibility{MinimumVersion: "1.0.0"}, UpdatePolicy: domain.RuntimeClientManagerUpdatePolicy{Strategy: "manual-staged", RequireApproval: true, HealthConfirmationSeconds: 60, RetainPrevious: true}}}
 	if err := svc.store.GamePlugins().Update(plugin); err != nil {
 		t.Fatalf("update plugin fixture: %v", err)
 	}
 	endpoint.Capabilities = append(endpoint.Capabilities,
 		domain.JobCapabilityRunSelfUpdate,
-		domain.JobCapabilityDependenciesCheck,
-		domain.JobCapabilityDependenciesInstall,
-		domain.JobCapabilityLogsBackfill,
-		domain.JobCapabilityClientManagerDeploy,
-		domain.JobCapabilityClientManagerControl,
-		domain.JobCapabilityClientManagerUpdate,
-		domain.JobCapabilityClientManagerRollback,
-		domain.JobCapabilityClientManagerUninstall,
+			domain.JobCapabilityDependenciesCheck,
+			domain.JobCapabilityDependenciesInstall,
+			domain.JobCapabilityLogsBackfill,
 	)
 	endpoint.Platform = "linux"
 	endpoint.Architecture = "amd64"
@@ -712,24 +648,6 @@ func readGeneratedPackageConfig(t *testing.T, svc *CoreService, session string,
 		}
 		return generatedPackageConfig{Kind: "run", ServerInstanceID: distribution.ServerInstanceID, PluginID: distribution.PluginID, RunEndpointID: distribution.RunEndpointID, TargetOS: distribution.TargetOS, TargetArch: distribution.TargetArch, SecretRef: distribution.SecretRef, KeyGeneration: distribution.KeyGeneration, AuthKey: plain}
 	}
-	clients, err := svc.store.ClientManagerDistributions().List(domain.ClientManagerDistributionFilter{})
-	if err != nil {
-		t.Fatalf("list client distributions: %v", err)
-	}
-	for _, distribution := range clients {
-		if distribution.ArtifactID != artifactID {
-			continue
-		}
-		key, err := svc.activeComponentKey(distribution.ServerInstanceID, domain.DistributionComponentClientManager, distribution.ProfileKey)
-		if err != nil {
-			t.Fatalf("get client key: %v", err)
-		}
-		plain, err := decryptRuntimeKey(key.EncryptedKey)
-		if err != nil {
-			t.Fatalf("decrypt client key: %v", err)
-		}
-		return generatedPackageConfig{Kind: "client-manager", ServerInstanceID: distribution.ServerInstanceID, PluginID: distribution.PluginID, ProfileKey: distribution.ProfileKey, TargetOS: distribution.TargetOS, TargetArch: distribution.TargetArch, SecretRef: distribution.SecretRef, KeyGeneration: distribution.KeyGeneration, AuthKey: plain}
-	}
 	t.Fatalf("distribution for artifact %s was not found", artifactID)
 	return generatedPackageConfig{}
 }
@@ -754,26 +672,6 @@ func completeDistributionBuild(t *testing.T, svc *CoreService, distribution doma
 	return domain.RunDistribution{}
 }
 
-func completeClientDistributionBuild(t *testing.T, svc *CoreService, distribution domain.ClientManagerDistribution, _ []byte) domain.ClientManagerDistribution {
-	t.Helper()
-	deadline := time.Now().Add(time.Second)
-	for time.Now().Before(deadline) {
-		updated, err := svc.store.ClientManagerDistributions().Get(distribution.ID)
-		if err != nil {
-			t.Fatalf("get client distribution: %v", err)
-		}
-		if updated.Status == domain.DistributionStatusAvailable {
-			return updated
-		}
-		if updated.Status == domain.DistributionStatusFailed {
-			t.Fatalf("platform client build failed: %+v", updated)
-		}
-		time.Sleep(time.Millisecond)
-	}
-	t.Fatalf("platform client build did not complete")
-	return domain.ClientManagerDistribution{}
-}
-
 func TestCoreServiceDeniesRunDistributionWithoutPluginDeclaration(t *testing.T) {
 	svc := newTestCoreService()
 	plugin, endpoint := createPluginAndRunEndpoint(t, svc)