Efremenko Arhip
3a1461315f
Let a signed-in user turn their own machine into a worker without the shared token. The coordinator already binds a JWT-authenticated registration to owner_id as untrusted; this adds the missing pieces. userservice: long-lived worker keys (scimesh_wk_live_*, hash-at-rest) with create/list/revoke and a public /worker-tokens/exchange that trades a key for a short-lived JWT carrying the owner current role/verified. python worker: SCIMESH_WORKER_KEY + SCIMESH_USERSERVICE_URL; a token provider exchanges the key and refreshes the JWT proactively and on 401, so a long-running worker survives token expiry. Static bearer token path is unchanged. coordinator UI: an "add your machine" page that mints a key and shows a ready-to-run command, proxying key management to the userservice; the dashboard gains an owner-scoped "my machines" section. docs: how to run a worker from your account, plus the untrusted/quorum/ verified trust model.
28 lines
1.1 KiB
Go
28 lines
1.1 KiB
Go
package usecase
|
|
|
|
import "errors"
|
|
|
|
var (
|
|
// Repository-contract errors, returned by UserRepository implementations.
|
|
ErrEmailExists = errors.New("email already registered")
|
|
ErrUserNotFound = errors.New("user not found")
|
|
|
|
// ErrWorkerKeyNotFound is returned by WorkerKeyRepository when no live key
|
|
// matches (by id for revoke, by hash for exchange).
|
|
ErrWorkerKeyNotFound = errors.New("worker key not found")
|
|
// ErrInvalidWorkerKey is surfaced to the transport layer for a key that does
|
|
// not exchange (unknown, revoked, or owner gone). Deliberately opaque so a
|
|
// caller cannot distinguish the cases while probing.
|
|
ErrInvalidWorkerKey = errors.New("invalid worker key")
|
|
|
|
// Use-case errors surfaced to the transport layer.
|
|
//
|
|
// ErrInvalidCredentials is deliberately returned for both an unknown email
|
|
// and a wrong password, so an attacker cannot use the response to learn
|
|
// which emails are registered.
|
|
ErrInvalidCredentials = errors.New("invalid email or password")
|
|
ErrPasswordTooShort = errors.New("password too short")
|
|
ErrPasswordTooLong = errors.New("password too long")
|
|
ErrInvalidRole = errors.New("invalid role")
|
|
)
|