From 22fd662fb794f63efb9d3ca2158de73c4e07e1b8 Mon Sep 17 00:00:00 2001 From: Richard Courtman Date: Mon, 31 Aug 2026 00:33:49 +0100 Subject: [PATCH] Match secure runtime revoke protocol --- .../secure_runtime_systemd_lab_test.go | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/scripts/installtests/secure_runtime_systemd_lab_test.go b/scripts/installtests/secure_runtime_systemd_lab_test.go index 1acb34b5b..e65406df2 100644 --- a/scripts/installtests/secure_runtime_systemd_lab_test.go +++ b/scripts/installtests/secure_runtime_systemd_lab_test.go @@ -549,7 +549,7 @@ func (f *secureRuntimeLabFixture) handleActionRunnerSelfRevoke(w http.ResponseWr return } f.actionServer.InvalidateActionRunnerSession(admission) - writeSecureRuntimeJSON(w, http.StatusOK, map[string]any{"success": true}) + w.WriteHeader(http.StatusNoContent) } func (f *secureRuntimeLabFixture) handleReport(w http.ResponseWriter, r *http.Request) { @@ -1086,6 +1086,23 @@ func TestSecureRuntimeFixtureAcceptsBearerOnlyCollectorLifecycleLookup(t *testin } } +func TestSecureRuntimeFixtureSelfRevokeUsesBodylessNoContentResponse(t *testing.T) { + fixture := newSecureRuntimeLabFixture(nil, "", nil, nil, "fixture") + defer fixture.actionServer.Shutdown() + body := fmt.Sprintf(`{"agentId":%q,"hostname":%q}`, secureRuntimeLabAgentID, secureRuntimeLabHostname) + request := httptest.NewRequest(http.MethodDelete, "/api/agents/action-runner/credential", strings.NewReader(body)) + request.Header.Set("Authorization", "Bearer "+secureRuntimeRunnerSecretV1) + recorder := httptest.NewRecorder() + fixture.ServeHTTP(recorder, request) + if recorder.Code != http.StatusNoContent || recorder.Body.Len() != 0 { + t.Fatalf("self-revoke response = status %d body %q, want bodyless 204", recorder.Code, recorder.Body.String()) + } + _, revoked, revokeCount := fixture.actionSnapshot() + if !revoked || revokeCount != 1 { + t.Fatalf("self-revoke state = revoked:%t count:%d", revoked, revokeCount) + } +} + func TestSecureRuntimeSystemdLab(t *testing.T) { if os.Getenv(secureRuntimeLabOptIn) != "1" { t.Skip("set PULSE_SECURE_RUNTIME_SYSTEMD_LAB=1 only inside a disposable systemd VM")