fix(master): block inventory writes from revoked agents (#6)

ApplySnapshot and UpsertService now take a FOR SHARE lock on the agent's row and refuse with model.ErrRevoked when it is revoked. RevokeAgent's UPDATE waits on that lock, so an in-flight snapshot or upsert can no longer bring a revoked agent's services back after the revoke cleanup.
2026-10-12 15:18:51 +02:00
parent 0e9e34db06
commit 2fe9b5ba0d
3 changed files with 72 additions and 3 deletions
@@ -15,6 +15,7 @@ import (
 var (
 	ErrNotFound = errors.New("not found")
 	ErrConflict = errors.New("already exists")
+	ErrRevoked  = errors.New("agent revoked")
 )

 // Agent is a registered agent. Whether it is connected right now is held in