feat(server): add observability and operator controls (#16)

2026-07-16 13:22:16 +02:00
parent 88ef946af5
commit be732de7c9
31 changed files with 4149 additions and 140 deletions
@@ -142,8 +142,36 @@ internal sealed class SigningKeyRing : IDisposable
        return VerificationKeyLookup.Available;
    }

-    public bool Revoke(string keyId) =>
-        _keys.ContainsKey(keyId) && _runtimeRevocations.TryAdd(keyId, 0);
+    public bool Revoke(string keyId)
+    {
+        if (!_keys.ContainsKey(keyId))
+        {
+            return false;
+        }
+
+        _runtimeRevocations.TryAdd(keyId, 0);
+        return true;
+    }
+
+    public IReadOnlyList<SigningKeyStatus> GetStatuses(DateTimeOffset now) => _keys.Values
+        .OrderBy(static key => key.KeyId, StringComparer.Ordinal)
+        .Select(key => new SigningKeyStatus(
+            key.KeyId,
+            IsRevoked(key)
+                ? "revoked"
+                : now < key.NotBefore
+                    ? "not-yet-valid"
+                    : now < key.SignUntil
+                        ? "signing"
+                        : now < key.VerifyUntil
+                            ? "verify-only"
+                            : "retired",
+            key.SignUntil,
+            key.VerifyUntil,
+            key.GameId,
+            key.EnvironmentId,
+            key.CredentialKinds.Select(static kind => kind.ToString()).Order().ToArray()))
+        .ToArray();

    public void Dispose()
    {
@@ -210,6 +238,15 @@ internal sealed class SigningKeyRing : IDisposable
    }
 }

+internal sealed record SigningKeyStatus(
+    string KeyId,
+    string Status,
+    DateTimeOffset SignUntil,
+    DateTimeOffset VerifyUntil,
+    string? GameId,
+    string? EnvironmentId,
+    IReadOnlyList<string> CredentialKinds);
+
 internal sealed class SigningKey : IDisposable
 {
    private byte[]? _material;