- adds tests/posture_revalidation_oidc_test.go: two positive tests (a hosted bind
terminator is revoked and its active circuit torn down when the host's posture
data goes invalid; an active dial circuit is revalidated and revoked when a
posture check is added to its dial policy) and two negative controls (a
posture-data change that stays compliant retains the terminator and circuit)
- fixes an inverted guard in revalidatePostureAccess: it skipped OIDC sessions
when it should skip legacy ones. Legacy posture is enforced controller-side via
session invalidation; only OIDC needs router-side revalidation, so the
requirement-change path was a no-op for the very sessions it protects
- makes the access-loss paths branch on the circuit's originator (dial vs host
side) instead of relying on serving conns having no service id. Host-side conns
are now stamped with their service at creation and expose IsHostSide(); dial
circuits are re-evaluated against dial access, host-side circuits against bind
access. This fixes the over-revocation surfaced by the negative control, where a
benign posture change tore down a host's serving circuits via a spurious
"service not found" dial denial
- makes bind-access revocation assertive: CloseForBindAccessLoss now tears the
active circuits served through a revoked terminator, found by iterating the
conn's circuits for host-side ones on that service. This covers both mux-sink
and SDK-xgress serving conns (xgEdgeForwarder already carries its originator
and service id), with no per-terminator bookkeeping, so a host that loses bind
access drops its established circuits promptly instead of draining
- renames the now-both-sided abstractions to match: state.DialCircuit ->
EdgeCircuit and ConnProvider.IterateDialCircuits -> IterateEdgeCircuits, the
per-circuit predicate to IsHostSide(), and the circuit close from
CloseForDialAccessLoss to CloseForAccessLoss(reason)
Paul Lorenz
eccdf7f420