feat: accept agent_instance identities - #34
Merged
Conversation
An agent workload authenticates as the instance it runs, not as the class. Without the type, expose rejects the identity and the workload cannot manage the exposures it owns. Adds the type and an isAgentWorkload predicate covering both it and the pre-migration class type, replacing three separate equality checks. Also repairs the test mocks, which no longer compiled against the current clients: mockZitiMgmt was missing CreateSandboxIdentity and twelve tunnel, service and policy methods, and mockRunners was missing the flavor, catalog and agent-instance lookups. That build failure is on main and is independent of this change. Co-Authored-By: Claude <noreply@anthropic.com>
The mocks hand-implemented every method of ZitiManagementServiceClient and RunnersServiceClient. Bindings are generated from BSR on every CI run, so adding an RPC to the API broke these repos without a commit touching them — and silently: expose last ran CI on 4 June, and CreateSandboxIdentity, the flavor RPCs and the agent-instance lookups all landed after, so main has not compiled since and nothing reported it. Embedding the interface makes the mock satisfy the contract by construction. Calling a method a test did not override panics, which is the right failure for a test, and new RPCs cannot break it. 29 and 32 methods drop to 4 and 2 — only what the tests actually stub. Co-Authored-By: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
An agent workload authenticates as the instance it runs
(ziti-management#81,
gateway#197). Without the type
here, expose rejects the identity and the workload cannot manage its exposures.
agent_instanceadded toidentitymetaand the server's identity type.isAgentWorkload()predicate replaces three separate!= identityTypeAgentchecks, so instances and pre-migration classidentities are handled in one place.
Also: main's tests do not compile
Independent of this change,
go test ./...fails onmain. The mocks driftedbehind the generated clients:
mockZitiMgmt— missingCreateSandboxIdentityplus twelve tunnel, serviceand policy methods
mockRunners— missing the flavor, catalog and agent-instance lookupsRepaired here, since this branch cannot be verified otherwise.
This replaces a CI monkey-patch carried by agents-orchestrator#226
(
patch-expose-agent-instances.js, 20 string anchors) that injected the samebehaviour by rewriting this repo's source during e2e. Deleted alongside this.
🤖 Generated with Claude Code