@feltdb/core 0.8.4 → 0.8.5

package/dist/create/server-source/crates/feltdb-server/src/app_state.rs

@@ -31,7 +31,7 @@ use feltdb::{
     sync_contract::SyncStore,
     worker_mesh::WorkerMeshStore,
     workload::WorkloadStore,
-    FeltDb,
+    FeltDb, StateTriggerStore,
 };
 
 #[derive(Clone)]
@@ -72,6 +72,7 @@ pub struct AppState {
     pub grants: Arc<std::sync::Mutex<GrantStore>>,
     pub sync: Arc<std::sync::Mutex<SyncStore>>,
     pub workloads: Arc<std::sync::Mutex<WorkloadStore>>,
+    pub state_triggers: Arc<std::sync::Mutex<StateTriggerStore>>,
     pub mesh: Arc<std::sync::Mutex<WorkerMeshStore>>,
     pub readiness_probe: Arc<PathBuf>,
     pub bounded_query_cursors: Arc<std::sync::Mutex<HashMap<String, BoundedQueryCursor>>>,

package/dist/create/server-source/crates/feltdb-server/src/auth.rs

@@ -40,6 +40,17 @@ pub struct ApiKeyRecord {
     pub namespaces: Vec<String>,
     #[serde(default)]
     pub revoked: bool,
+    /// The worker this credential *is*, when it is a worker credential.
+    ///
+    /// A key without one authenticates as a service, which is what every key
+    /// did before this field existed and what every key without it still does.
+    /// A key with one authenticates as `Subject::Worker(worker_id)` and is
+    /// thereby **narrower**, not wider: the worker lifecycle routes compare the
+    /// authenticated subject against the `worker_id` in the request body, so
+    /// such a credential can act as exactly one worker and no other, and cannot
+    /// satisfy a check that requires a human or service subject.
+    #[serde(default)]
+    pub worker_id: Option<String>,
 }
 
 #[derive(Debug, Clone, Serialize)]
@@ -104,6 +115,9 @@ impl KeyStore {
                             scopes: token.scopes,
                             namespaces: vec![token.namespace],
                             revoked: false,
+                            // Legacy credentials predate worker identity and
+                            // stay services, which is what they already were.
+                            worker_id: None,
                         });
                     }
                     (records, true)
@@ -141,12 +155,25 @@ impl KeyStore {
                     .iter()
                     .any(|allowed| allowed == "*" || allowed == namespace);
                 if namespace_allowed && verify_api_key(token, &record.hash) {
-                    Some(Principal {
-                        key_id: record.id.clone(),
-                        scopes: record.scopes.clone(),
-                        subject_type: "service".into(),
-                        identity_id: None,
-                        session_id: None,
+                    // The credential decides the subject type. A worker
+                    // credential can never present as a service and a service
+                    // credential can never present as a worker, because neither
+                    // the request nor any header participates in this choice.
+                    Some(match &record.worker_id {
+                        Some(worker) => Principal {
+                            key_id: record.id.clone(),
+                            scopes: record.scopes.clone(),
+                            subject_type: "worker".into(),
+                            identity_id: Some(worker.clone()),
+                            session_id: None,
+                        },
+                        None => Principal {
+                            key_id: record.id.clone(),
+                            scopes: record.scopes.clone(),
+                            subject_type: "service".into(),
+                            identity_id: None,
+                            session_id: None,
+                        },
                     })
                 } else {
                     None
@@ -159,6 +186,21 @@ impl KeyStore {
         name: String,
         scopes: Vec<String>,
         namespaces: Vec<String>,
+    ) -> Result<CreatedApiKey, String> {
+        self.create_for_worker(name, scopes, namespaces, None)
+    }
+
+    /// Issue a credential that authenticates as one specific worker.
+    ///
+    /// `worker_id` of `None` produces an ordinary service credential, so this
+    /// is the one construction path and [`KeyStore::create`] is the common case
+    /// spelled out.
+    pub fn create_for_worker(
+        &self,
+        name: String,
+        scopes: Vec<String>,
+        namespaces: Vec<String>,
+        worker_id: Option<String>,
     ) -> Result<CreatedApiKey, String> {
         let secret: String = rand::thread_rng()
             .sample_iter(&Alphanumeric)
@@ -185,6 +227,7 @@ impl KeyStore {
                 scopes,
                 namespaces,
                 revoked: false,
+                worker_id,
             });
         self.persist()?;
         Ok(CreatedApiKey { id, secret: token })
@@ -266,13 +309,11 @@ fn verify_api_key(token: &str, stored_hash: &str) -> bool {
             .is_ok();
     }
 
-    PasswordHash::new(stored_hash)
-        .ok()
-        .is_some_and(|parsed| {
-            Argon2::default()
-                .verify_password(token.as_bytes(), &parsed)
-                .is_ok()
-        })
+    PasswordHash::new(stored_hash).ok().is_some_and(|parsed| {
+        Argon2::default()
+            .verify_password(token.as_bytes(), &parsed)
+            .is_ok()
+    })
 }
 
 #[cfg(test)]
@@ -341,4 +382,114 @@ mod tests {
         assert!(migrated.contains("managed-instance"));
         let _ = fs::remove_file(path);
     }
+
+    // ------------------------------------------------------------------
+    // Worker identity.
+    //
+    // The whole worker security boundary rests on one thing: which subject a
+    // credential authenticates as. That is decided here, by the stored
+    // credential alone — no request field, header or body participates — so
+    // these tests are the root of the boundary the workload lifecycle routes
+    // enforce further up.
+    // ------------------------------------------------------------------
+
+    fn key_store(name: &str) -> (PathBuf, KeyStore) {
+        let path = std::env::temp_dir().join(format!(
+            "feltdb-worker-identity-{name}-{}-{}.json",
+            std::process::id(),
+            rand::random::<u64>()
+        ));
+        let _ = fs::remove_file(&path);
+        let store = KeyStore::load(&path).unwrap();
+        (path, store)
+    }
+
+    #[test]
+    fn a_worker_credential_authenticates_as_that_one_worker() {
+        let (path, store) = key_store("worker");
+        let key = store
+            .create_for_worker(
+                "extractor".into(),
+                vec!["state:read".into()],
+                vec!["default".into()],
+                Some("worker-x".into()),
+            )
+            .unwrap();
+
+        let principal = store
+            .authenticate(&key.secret, "default")
+            .expect("authenticates");
+        assert_eq!(principal.subject_type, "worker");
+        assert_eq!(
+            principal.identity_id.as_deref(),
+            Some("worker-x"),
+            "the worker it is, not the key it uses, is the identity"
+        );
+        let _ = fs::remove_file(path);
+    }
+
+    #[test]
+    fn a_service_credential_cannot_present_as_a_worker() {
+        let (path, store) = key_store("service");
+        let key = store
+            .create(
+                "control-plane".into(),
+                vec!["state:read".into()],
+                vec!["default".into()],
+            )
+            .unwrap();
+
+        let principal = store
+            .authenticate(&key.secret, "default")
+            .expect("authenticates");
+        assert_eq!(
+            principal.subject_type, "service",
+            "a key issued without a worker is a service, exactly as before this field existed"
+        );
+        assert_eq!(principal.identity_id, None);
+        let _ = fs::remove_file(path);
+    }
+
+    #[test]
+    fn worker_identity_survives_a_restart_of_the_credential_store() {
+        let (path, store) = key_store("reload");
+        let key = store
+            .create_for_worker(
+                "extractor".into(),
+                vec!["state:read".into()],
+                vec!["default".into()],
+                Some("worker-x".into()),
+            )
+            .unwrap();
+        drop(store);
+
+        // A credential that forgot which worker it was on restart would silently
+        // downgrade to a service and start failing the identity check.
+        let reopened = KeyStore::load(&path).unwrap();
+        let principal = reopened
+            .authenticate(&key.secret, "default")
+            .expect("authenticates");
+        assert_eq!(principal.subject_type, "worker");
+        assert_eq!(principal.identity_id.as_deref(), Some("worker-x"));
+        let _ = fs::remove_file(path);
+    }
+
+    #[test]
+    fn a_revoked_worker_credential_authenticates_as_nothing() {
+        let (path, store) = key_store("revoked");
+        let key = store
+            .create_for_worker(
+                "extractor".into(),
+                vec!["state:read".into()],
+                vec!["default".into()],
+                Some("worker-x".into()),
+            )
+            .unwrap();
+        assert!(store.revoke(&key.id).unwrap());
+        assert!(
+            store.authenticate(&key.secret, "default").is_none(),
+            "revocation is not weakened by carrying a worker identity"
+        );
+        let _ = fs::remove_file(path);
+    }
 }

package/dist/create/server-source/crates/feltdb-server/src/main.rs

@@ -62,7 +62,7 @@ use feltdb::{
     },
     workload::{CreateWorkload, WorkloadStore},
     AtomicMutation, DatabaseSnapshot, FeltDb, FlowError, JsonCasResult, Operation,
-    PeerAdvertisement, PeerId, RecordPrecondition, StoredRow,
+    PeerAdvertisement, PeerId, RecordPrecondition, StateTriggerStore, StoredRow,
 };
 use feltdb_server::{
     app_state::{AppState, BoundedQueryCursor},
@@ -1421,9 +1421,10 @@ struct WorkerReconcileRequest {
 fn workload_error(error: feltdb::workload::WorkloadError) -> ApiError {
     let status = match error.code.as_str() {
         "WORKLOAD_NOT_FOUND" => StatusCode::NOT_FOUND,
-        "WORKLOAD_STALE_FENCE" | "WORKLOAD_TRANSITION_DENIED" | "WORKLOAD_NOT_READY" => {
-            StatusCode::CONFLICT
-        }
+        "WORKLOAD_STALE_FENCE"
+        | "WORKLOAD_TRANSITION_DENIED"
+        | "WORKLOAD_NOT_READY"
+        | "WORKLOAD_NOT_YET_ELIGIBLE" => StatusCode::CONFLICT,
         "WORKLOAD_UNAUTHORIZED" | "WORKLOAD_CAPABILITY_DENIED" => StatusCode::FORBIDDEN,
         "WORKLOAD_STORAGE_FAILURE" => StatusCode::SERVICE_UNAVAILABLE,
         _ => StatusCode::UNPROCESSABLE_ENTITY,
@@ -8289,6 +8290,9 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
     if manage_workloads()? {
         return Ok(());
     }
+    if manage_state_triggers()? {
+        return Ok(());
+    }
     if manage_backup()? {
         return Ok(());
     }
@@ -8336,6 +8340,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
     let grant_store = GrantStore::load(config.data.with_extension("grants.json"))?;
     let sync_store = SyncStore::load(config.data.with_extension("sync.json"))?;
     let workload_store = WorkloadStore::load(config.data.with_extension("workloads.json"))?;
+    let state_trigger_store = StateTriggerStore::load(config.data.with_extension("triggers.json"))?;
     let mesh_store = WorkerMeshStore::load(config.data.with_extension("workers.json"))?;
     let content_store = ContentStore::new(config.data.with_extension("content"))?;
     let artifact_store = ArtifactStore::load(
@@ -8403,6 +8408,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
         grants: Arc::new(std::sync::Mutex::new(grant_store)),
         sync: Arc::new(std::sync::Mutex::new(sync_store)),
         workloads: Arc::new(std::sync::Mutex::new(workload_store)),
+        state_triggers: Arc::new(std::sync::Mutex::new(state_trigger_store)),
         mesh: Arc::new(std::sync::Mutex::new(mesh_store)),
         readiness_probe: Arc::new(readiness_probe),
         bounded_query_cursors: Arc::new(std::sync::Mutex::new(HashMap::new())),
@@ -9566,10 +9572,15 @@ fn manage_keys() -> Result<bool, Box<dyn std::error::Error>> {
                     .map(str::to_string)
                     .collect()
             };
-            let key = store.create(
+            // `--worker <id>` issues a credential that authenticates as that
+            // one worker rather than as a service. It is a narrowing: the
+            // worker lifecycle routes accept it only for its own worker id, and
+            // it cannot satisfy a check that wants a human or a service.
+            let key = store.create_for_worker(
                 name,
                 values("--scope", "state:read,state:write,events:read"),
                 values("--namespace", "default"),
+                option("--worker"),
             )?;
             println!(
                 "API key created (id: {}). This secret will not be shown again:\n{}",
@@ -9584,7 +9595,7 @@ fn manage_keys() -> Result<bool, Box<dyn std::error::Error>> {
             }
             println!("API key revoked: {id}");
         }
-        _ => return Err("usage: feltdb-server keys <create|list|revoke> [--keys path] [--name name] [--scope scopes] [--namespace names] [--id key-id]".into()),
+        _ => return Err("usage: feltdb-server keys <create|list|revoke> [--keys path] [--name name] [--scope scopes] [--namespace names] [--worker worker-id] [--id key-id]".into()),
     }
     Ok(true)
 }
@@ -9682,6 +9693,61 @@ fn manage_workloads() -> Result<bool, Box<dyn std::error::Error>> {
     Ok(true)
 }
 
+fn manage_state_triggers() -> Result<bool, Box<dyn std::error::Error>> {
+    let arguments: Vec<String> = std::env::args().collect();
+    if arguments.get(1).map(String::as_str) != Some("trigger") {
+        return Ok(false);
+    }
+    let command = arguments.get(2).map(String::as_str).unwrap_or("list");
+    let option = |name: &str| {
+        arguments
+            .iter()
+            .position(|value| value == name)
+            .and_then(|index| arguments.get(index + 1))
+            .cloned()
+    };
+    let data = PathBuf::from(option("--data").unwrap_or_else(|| "./data/feltdb.log".into()));
+    let trigger_path = PathBuf::from(option("--store").unwrap_or_else(|| {
+        data.with_extension("triggers.json")
+            .to_string_lossy()
+            .into_owned()
+    }));
+    let mut triggers = StateTriggerStore::load(trigger_path)?;
+    match command {
+        "define" => {
+            let input = option("--input").ok_or("trigger define requires --input trigger.json")?;
+            let trigger: feltdb::StateTrigger = serde_json::from_slice(&std::fs::read(input)?)?;
+            triggers.define(trigger)?;
+            println!("{}", serde_json::to_string_pretty(&triggers.list())?);
+        }
+        "list" => println!("{}", serde_json::to_string_pretty(&triggers.list())?),
+        "status" => println!(
+            "{}",
+            serde_json::to_string_pretty(&json!({
+                "triggers": triggers.triggers.len(),
+                "cursors": triggers.cursor_versions(),
+            }))?
+        ),
+        "evaluate" => {
+            let db = FeltDb::open(&data)?;
+            let workload_path = PathBuf::from(
+                option("--workload-store")
+                    .unwrap_or_else(|| data.with_extension("workloads.json").to_string_lossy().into_owned()),
+            );
+            let mut workloads = WorkloadStore::load(workload_path)?;
+            let produced = triggers.evaluate(&db, &mut workloads, unix_seconds_i64())?;
+            println!("{}", serde_json::to_string_pretty(&produced)?);
+        }
+        _ => {
+            return Err(
+                "usage: feltdb-server trigger <define|list|status|evaluate> [--data path] [--store path] [--workload-store path] [--input trigger.json]"
+                    .into(),
+            )
+        }
+    }
+    Ok(true)
+}
+
 fn manage_backup() -> Result<bool, Box<dyn std::error::Error>> {
     let arguments: Vec<String> = std::env::args().collect();
     if arguments.get(1).map(String::as_str) != Some("backup") {
@@ -10103,6 +10169,197 @@ async fn run_worker_pass(state: &AppState) -> Result<(), ApiError> {
         }
         execute_agent_run(state, &row.value, &worker).await?;
     }
+
+    evaluate_state_triggers(state)?;
+    execute_eligible_workloads(state, &worker)?;
+    Ok(())
+}
+
+/// How long an autonomous claim holds its lease.
+///
+/// Long enough that an ordinary capability program finishes inside it, short
+/// enough that a worker dying mid-execution returns the work quickly. The lease
+/// is the only thing that makes worker death recoverable, so this is a real
+/// bound rather than a formality.
+const WORKLOAD_LEASE_MS: u64 = 30_000;
+
+fn state_trigger_store(
+    state: &AppState,
+) -> Result<std::sync::MutexGuard<'_, feltdb::StateTriggerStore>, ApiError> {
+    state.state_triggers.lock().map_err(|_| {
+        ApiError(
+            StatusCode::INTERNAL_SERVER_ERROR,
+            "state trigger store unavailable".into(),
+        )
+    })
+}
+
+fn state_trigger_error(error: feltdb::StateTriggerError) -> ApiError {
+    let status = match error.code.as_str() {
+        "TRIGGER_INVALID" | "TRIGGER_UNAUTHORIZED" => StatusCode::BAD_REQUEST,
+        "WORKLOAD_UNAUTHORIZED" => StatusCode::FORBIDDEN,
+        "TRIGGER_STATE_REPLAY_FAILED" | "TRIGGER_STORAGE_FAILURE" | "WORKLOAD_STORAGE_FAILURE" => {
+            StatusCode::SERVICE_UNAVAILABLE
+        }
+        _ => StatusCode::CONFLICT,
+    };
+    ApiError(
+        status,
+        serde_json::to_string(&error).unwrap_or(error.message),
+    )
+}
+
+fn evaluate_state_triggers(state: &AppState) -> Result<(), ApiError> {
+    let mut triggers = state_trigger_store(state)?;
+    if triggers.triggers.is_empty() {
+        return Ok(());
+    }
+    let mut workloads = workload_store(state)?;
+    triggers
+        .evaluate(&state.db, &mut workloads, unix_seconds_i64())
+        .map_err(state_trigger_error)?;
+    Ok(())
+}
+
+/// The durable workload store, or a service error if its lock is poisoned.
+fn workload_store(
+    state: &AppState,
+) -> Result<std::sync::MutexGuard<'_, feltdb::workload::WorkloadStore>, ApiError> {
+    state.workloads.lock().map_err(|_| {
+        ApiError(
+            StatusCode::INTERNAL_SERVER_ERROR,
+            "workload store unavailable".into(),
+        )
+    })
+}
+
+/// The capabilities this node can actually run.
+///
+/// This is what the worker presents to [`WorkloadStore::claim`], which requires
+/// the workload's `capability_snapshot` to be a subset of it. That check is
+/// therefore load-bearing rather than ceremonial: a workload whose declared
+/// capabilities this node cannot execute is never claimed by it, and stays
+/// `Ready` for a node that can.
+fn worker_capabilities(state: &AppState) -> Result<BTreeSet<String>, ApiError> {
+    let mut capabilities: BTreeSet<String> = ["search", "identity"]
+        .into_iter()
+        .map(str::to_string)
+        .collect();
+    for row in state.db.list_collection("_flow_capabilities")? {
+        if let Some((_, name)) = row.key.split_once(':') {
+            capabilities.insert(name.to_string());
+        }
+    }
+    Ok(capabilities)
+}
+
+/// Claim and execute the durable workloads this node is eligible to run.
+///
+/// This is the composition that makes `WorkloadStore` an execution primitive
+/// rather than a work data model. It adds no queue and no worker system: the
+/// scan is the pass that already runs, the claim is the existing lease and
+/// fencing, the execution is the existing capability interpreter, and the
+/// transitions are the existing state machine.
+///
+/// Temporal eligibility needs no special handling here — `Workload::is_eligible_at`
+/// filters candidates and `WorkloadStore::claim` refuses anything early, so
+/// `not_before` and retry backoff gate this path by construction.
+///
+/// The store lock is released before execution. A capability program reads
+/// application state through the same database, so holding the workload lock
+/// across it would make every other workload operation wait on unrelated work.
+fn execute_eligible_workloads(state: &AppState, worker: &str) -> Result<(), ApiError> {
+    let capabilities = worker_capabilities(state)?;
+    let now = unix_seconds_i64();
+    let candidates: Vec<(String, String, Value)> = {
+        let store = workload_store(state)?;
+        store
+            .workloads
+            .values()
+            // Selection, not enforcement. `WorkloadStore::claim` independently
+            // refuses work that is early or beyond this node's capabilities, and
+            // that is where the guarantee lives; filtering here only avoids
+            // attempting a claim, every pass, that is known to be refused.
+            .filter(|workload| {
+                workload.state == feltdb::workload::WorkloadState::Ready
+                    && workload.is_eligible_at(now)
+                    && workload.capability_snapshot.is_subset(&capabilities)
+            })
+            .map(|workload| {
+                (
+                    workload.workload_id.clone(),
+                    workload.definition_id.clone(),
+                    workload.input.clone(),
+                )
+            })
+            .collect()
+    };
+
+    for (id, definition, input) in candidates {
+        // Unlike the filter above, this one is enforcement: nothing downstream
+        // knows whether `definition_id` names something runnable. Claiming a
+        // workload only to dead-letter it would consume work another node could
+        // have executed, so an unrunnable definition is left untouched.
+        if !is_executable_capability(state, &definition)? {
+            continue;
+        }
+        let claim = match workload_store(state)?.claim(
+            &id,
+            worker,
+            &capabilities,
+            unix_seconds_i64(),
+            WORKLOAD_LEASE_MS,
+        ) {
+            Ok(claim) => claim,
+            // Another worker took it, or eligibility moved between the scan and
+            // the claim. Both are ordinary outcomes of concurrent workers, not
+            // failures of this pass.
+            Err(_) => continue,
+        };
+        workload_store(state)?
+            .start(
+                &id,
+                &claim.claim_id,
+                worker,
+                claim.fencing_token,
+                unix_seconds_i64(),
+            )
+            .map_err(workload_error)?;
+
+        match execute_named_capability(state, &definition, &input) {
+            Ok(output) => {
+                workload_store(state)?
+                    .complete(
+                        &id,
+                        &claim.claim_id,
+                        worker,
+                        claim.fencing_token,
+                        &format!("result_{id}_{}", claim.fencing_token),
+                        output,
+                        vec![],
+                        1,
+                        unix_seconds_i64(),
+                    )
+                    .map_err(workload_error)?;
+            }
+            Err(error) => {
+                // A capability program that fails does so deterministically, so
+                // this failure kind is deliberately outside the default
+                // `retry_on` set: retrying it would burn attempts to reach the
+                // same dead letter. Only the message is carried, because the
+                // store refuses failure text that looks like a secret.
+                let _ = workload_store(state)?.fail(
+                    &id,
+                    &claim.claim_id,
+                    worker,
+                    claim.fencing_token,
+                    "execution_error",
+                    &format!("capability {definition} failed with status {}", error.0),
+                    unix_seconds_i64(),
+                );
+            }
+        }
+    }
     Ok(())
 }
 
@@ -13008,6 +13265,69 @@ async fn shutdown_signal() {
     tokio::select! { _ = ctrl_c => {}, _ = terminate => {} }
 }
 
+#[cfg(test)]
+mod worker_identity_tests {
+    use super::grant_subject;
+    use feltdb::authorization::Subject as GrantSubject;
+    use feltdb_server::auth::Principal;
+
+    fn principal(subject_type: &str, identity: Option<&str>) -> Principal {
+        Principal {
+            key_id: "key-1".into(),
+            scopes: vec!["*".into()],
+            subject_type: subject_type.into(),
+            identity_id: identity.map(str::to_string),
+            session_id: None,
+        }
+    }
+
+    /// The workload worker lifecycle compares the authenticated subject against
+    /// the `worker_id` in the request, so which subject each principal maps to
+    /// *is* the security boundary. Nothing but the authenticated principal
+    /// participates in this mapping.
+    #[test]
+    fn only_a_worker_principal_maps_to_a_worker_subject() {
+        assert_eq!(
+            grant_subject(&principal("worker", Some("worker-x"))),
+            GrantSubject::Worker("worker-x".into()),
+        );
+        // Every other principal maps somewhere a worker check can never accept,
+        // no matter what identity it carries or what scopes it holds.
+        for (subject_type, expected) in [
+            ("human", GrantSubject::Human("worker-x".into())),
+            ("user", GrantSubject::Human("worker-x".into())),
+            ("service", GrantSubject::Service("worker-x".into())),
+            ("api_key", GrantSubject::Service("worker-x".into())),
+            ("agent", GrantSubject::Agent("worker-x".into())),
+        ] {
+            let subject = grant_subject(&principal(subject_type, Some("worker-x")));
+            assert_eq!(subject, expected, "{subject_type} mapped unexpectedly");
+            assert_ne!(
+                subject,
+                GrantSubject::Worker("worker-x".into()),
+                "{subject_type} must never satisfy a worker check"
+            );
+        }
+    }
+
+    /// A worker principal is one worker, not any worker.
+    #[test]
+    fn a_worker_subject_is_bound_to_its_own_identity() {
+        let subject = grant_subject(&principal("worker", Some("worker-x")));
+        assert_ne!(subject, GrantSubject::Worker("worker-y".into()));
+    }
+
+    /// Without an identity the principal falls back to its key id, so a worker
+    /// credential missing its worker id cannot silently become a wildcard.
+    #[test]
+    fn a_worker_principal_without_an_identity_falls_back_to_its_key_id() {
+        assert_eq!(
+            grant_subject(&principal("worker", None)),
+            GrantSubject::Worker("key-1".into()),
+        );
+    }
+}
+
 #[cfg(test)]
 mod authority_gate_tests {
     use super::{api_error_body, authorize_transaction_collections, state_authorization};