Files

T

genichinandClaude Sonnet 4.6 c815ce39b6 feat: dcy-003/004 토큰 surface 개편 및 daemon lifecycle 정책 구현 (BAT-006/007)

BAT-006 (REQ-016/017/018):
- client token 발급 경로 제거 (issue_client_token, POST /auth/tokens, 관련 스키마/테스트)
- service-token rotate unique index revoked_at IS NULL 조건 추가 (Alembic CONCURRENTLY 마이그레이션)
- POST /auth/service-tokens body daemon_id forward 누락 보정 (1-line fix)

BAT-007 (REQ-022/023):
- daemon deactivate 시 바인딩 service token 자동 revoke (CLI --force 옵션 + revoke_tokens_by_daemon_id)
- NULL daemon_id legacy token 진단 CLI (migrate-null-daemon --dry-run)

거버넌스 문서: dcy-003/004 Discovery, REQ-016~023/025~032 신규, BAT-006/007 전체 산출물

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-21 01:03:39 +00:00

3.1 KiB

Raw Blame History

BAT-006 Verification

Status: release-candidate
Batch: BAT-006

Acceptance Mapping

REQ-017:
- AC-1: rotate 시퀀스(issue → rotate) 실 DB 성공, unique 위반 없음 → tests/test_service_token_rotate_integration.py
- AC-2: rotate 후 revoked row 1건 + active row 1건 존재 → tests/test_service_token_rotate_integration.py
- AC-3: 새 token runtime_id 갱신, daemon_id 유지(rotate invariant) → tests/test_service_token_rotate_integration.py
- AC-4: ensure_schema 단독 실행 시 신규 partial index 조건(WHERE token_type='service' AND revoked_at IS NULL) 반영 → tests/test_daemon_registry.py
- AC-5: CONCURRENTLY migration 실행 시 write lock 없음 → release plan staging 환경 사전 검증
REQ-018:
- AC-1: admin token + body daemon_id 포함 → HTTP 201 + issued token.daemon_id 일치 → tests/test_auth.py
- AC-2: 비존재 daemon_id body → HTTP 4xx + 오류 메시지 → tests/test_auth.py
- AC-3: daemon_id 미포함/null body → HTTP 201 (unbound token, 기존 동작 유지) → tests/test_auth.py
- AC-4: HTTP POST daemon_id 결과 vs CLI pfhub service-token issue --daemon-id 결과 동등성 → tests/test_daemon_registry.py
REQ-016:
- AC-1: grep -rn "issue_client_token\|CreateClientTokenRequest\|IssuedClientTokenResponse" → 0건 → tests/test_auth_surface_after_client_deprecation.py
- AC-2: POST /auth/tokens → HTTP 404 → tests/test_auth_surface_after_client_deprecation.py
- AC-3: release 직전 SELECT COUNT(*) FROM auth_tokens WHERE token_type='client' AND revoked_at IS NULL → COUNT=0 → release plan evidence
- AC-4: dcy-003 token_type 게이트 회귀 테스트 → 모두 통과 → tests/test_v1*.py

Evidence

Test:
- pytest 255 passed (8.13s) — REQ-016/017/018 신규 테스트 9개 포함, regression 없음
- tests/test_auth.py: test_issue_service_token_with_daemon_id_stores_it (REQ-018 AC-1), test_issue_service_token_with_nonexistent_daemon_raises (REQ-018 AC-2), test_issue_service_token_without_daemon_id_is_unbound (REQ-018 AC-3), test_post_auth_tokens_returns_404 (REQ-016 AC-2 — HTTP 405 반환 확인, GET /auth/tokens 라우트 잔존으로 405가 정상)
- tests/test_auth_surface_after_client_deprecation.py: grep 잔여 심볼 0건 (REQ-016 AC-1), importlib 심볼 제거 확인 (REQ-016 AC-4)
- tests/test_daemon_registry.py: rotate 회귀 3개 통과 (REQ-017 AC-4)
Manual:
- app/repositories/postgres.py:ensure_schema() index 조건 WHERE token_type='service' AND revoked_at IS NULL 갱신 확인
- grep -rn "issue_client_token\|CreateClientTokenRequest\|IssuedClientTokenResponse" → 0건 (test_auth_surface_after_client_deprecation.py 자체 제외)
Logs:
- .venv/bin/python -m pytest -q → 255 passed in 8.13s

Result

Ready for Release: true
Blocking Issues:
- REQ-017 AC-1~3/5: 실 DB(docker-compose.local-test.yml) 환경 검증 미완료 — release plan에 staging 검증 의무화 필요
- REQ-016 AC-3: release 직전 SELECT COUNT(*) FROM auth_tokens WHERE token_type='client' AND revoked_at IS NULL → COUNT=0 재확인을 release plan evidence로 첨부 필요

3.1 KiB Raw Blame History

BAT-006 Verification

Acceptance Mapping

Evidence

Result

3.1 KiB

Raw Blame History