Make Connect machine revocation retries idempotent

apps/web/src/server/api.test.ts

@@ -589,6 +589,49 @@ describe("server-authenticated machine-code round trip", () => {
       db.select().from(machine).where(eq(machine.id, redeemed.machineId)).get()
         ?.revokedAt,
     ).not.toBeNull();
+    const revokedAt = db.select().from(machine).get()?.revokedAt;
+    for (const token of [serverCredential, "bbcred_other"]) {
+      await expect(
+        revokeMachineForServerCredential(deps, token, redeemed.machineId),
+      ).resolves.toEqual({ ok: true });
+    }
+    expect(db.select().from(machine).get()?.revokedAt).toEqual(revokedAt);
+    await expect(
+      revokeMachineForServerCredential(deps, serverCredential, "missing"),
+    ).resolves.toEqual({ error: "not-found", status: 404 });
+    seedUser("foreign");
+    db.insert(machine)
+      .values({
+        id: "foreign-device",
+        userId: "foreign",
+        credentialHash: "foreign-hash",
+        createdAt: new Date(),
+        revokedAt: new Date(),
+      })
+      .run();
+    await expect(
+      revokeMachineForServerCredential(
+        deps,
+        serverCredential,
+        "foreign-device",
+      ),
+    ).resolves.toEqual({ error: "not-found", status: 404 });
+    for (const token of ["", "bogus"]) {
+      await expect(
+        revokeMachineForServerCredential(deps, token, redeemed.machineId),
+      ).resolves.toEqual({ error: "unauthorized", status: 401 });
+    }
+    db.update(server)
+      .set({ revokedAt: new Date() })
+      .where(eq(server.id, target.server.id))
+      .run();
+    await expect(
+      revokeMachineForServerCredential(
+        deps,
+        serverCredential,
+        redeemed.machineId,
+      ),
+    ).resolves.toEqual({ error: "unauthorized", status: 401 });
     await expect(redeemMachineCode(deps, minted.code)).resolves.toMatchObject({
       error: "already-used",
       status: 409,
@@ -652,6 +695,10 @@ describe("dashboard machine recovery", () => {
     expect(closeTunnel).toHaveBeenCalledWith("lost-laptop:lost-generation");
     expect(closeTunnel).toHaveBeenCalledTimes(1);
     expect((await getAccountState(deps, "u1")).machines).toEqual([]);
+    await expect(revokeMachine(deps, "u1", "machine-owner")).resolves.toEqual({
+      ok: true,
+    });
+    expect(closeTunnel).toHaveBeenCalledTimes(1);
     expect(
       db.select().from(machine).where(eq(machine.id, "machine-owner")).get()
         ?.subdomain,

apps/web/src/server/api.ts

@@ -279,7 +279,6 @@ export async function revokeMachine(
       and(eq(labelClaim.kind, "machine"), eq(labelClaim.ownerId, machineId)),
     )
     .get();
-  if (!claim && existing.revokedAt !== null) return { error: "not-found" };
 
   if (claim) {
     try {