Require administrator-requested host credential rotation (Refs #97)

2026-10-12 19:13:29 -04:00
parent 272055a1ed
commit 1b908f891f
5 changed files with 162 additions and 6 deletions
@@ -433,6 +433,7 @@ describe('native host enrollment and scoped authentication', () => {
        const api = await enrolled();
        const other = api.createHost({ name: 'Other' });
        const second = api.enrollHost(api.createEnrollment(other.id).token, inventory);
+        api.queueHostOperation(api.host.id, 'credentials.rotate', {});
        const rotated = api.rotateCredential(api.host.id);
        expect(api.authenticateCredential(api.credentials.credential)).toBeNull();
        expect(api.authenticateCredential(rotated)?.id).toBe(api.host.id);
@@ -472,6 +473,7 @@ describe('native host enrollment and scoped authentication', () => {
    it('recovers credential rotation when acknowledgement is lost using the agent-persisted replacement', async () => {
        const api = await enrolled();
        const next = 'ec_host_' + randomBytes(32).toString('base64url');
+        api.queueHostOperation(api.host.id, 'credentials.rotate', {});
        expect(api.rotateCredential(api.host.id, next)).toBe(next);
        expect(api.authenticateCredential(api.credentials.credential)).toBeNull();
        expect(api.authenticateCredential(next)?.id).toBe(api.host.id);