From 1bca4c1f4936c028a31bab5d8c87aa17be14dc7f Mon Sep 17 00:00:00 2001
From: Kayshen-X <kayshen_xu@163.com>
Date: Sat, 8 Aug 2026 22:59:05 +0800
Subject: [PATCH] fix(desktop): update collab smoke to the PeerIdentityPolicy
 admission API
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The pairing-code hardening changed the admission exchange's
expected-subject parameter into PeerIdentityPolicy, but the smoke
harness only builds under --features test-issuer, which no workspace
gate compiles — CI's two-process collaboration step was the first
thing to notice. All four call sites now pass the SameAccount policy;
the full 8-scenario smoke run passes again.
---
 crates/op-collab-smoke/src/auth.rs            | 11 ++++++++---
 crates/op-collab-smoke/src/fault_transport.rs |  6 +++---
 crates/op-collab-smoke/src/guest.rs           |  4 ++--
 crates/op-collab-smoke/src/owner.rs           |  4 ++--
 4 files changed, 15 insertions(+), 10 deletions(-)

diff --git a/crates/op-collab-smoke/src/auth.rs b/crates/op-collab-smoke/src/auth.rs
index 155d006c2..d855ff0f5 100644
--- a/crates/op-collab-smoke/src/auth.rs
+++ b/crates/op-collab-smoke/src/auth.rs
@@ -5,7 +5,8 @@ use op_auth_bridge::{
 };
 use op_collab::VerifiedAuthMetadata;
 use op_collab_transport::{
-    verify_initial_ticket, AdmissionError, DeviceStaticKey, TicketVerifier, VerifiedTicketClaims,
+    verify_initial_ticket, AdmissionError, DeviceStaticKey, PeerIdentityPolicy, TicketVerifier,
+    VerifiedTicketClaims,
 };
 use std::time::{Instant, SystemTime, UNIX_EPOCH};
 
@@ -125,6 +126,10 @@ pub const fn expected_issuer() -> &'static str {
     TEST_COLLAB_ISSUER
 }
 
-pub const fn expected_subject() -> &'static str {
-    TEST_SUBJECT
+/// The admission identity policy every smoke peer expects: both test devices
+/// are issued under the shared [`TEST_SUBJECT`] account.
+pub const fn expected_identity_policy() -> PeerIdentityPolicy<'static> {
+    PeerIdentityPolicy::SameAccount {
+        subject: TEST_SUBJECT,
+    }
 }
diff --git a/crates/op-collab-smoke/src/fault_transport.rs b/crates/op-collab-smoke/src/fault_transport.rs
index e8ed7e38b..b389a33ec 100644
--- a/crates/op-collab-smoke/src/fault_transport.rs
+++ b/crates/op-collab-smoke/src/fault_transport.rs
@@ -1,4 +1,4 @@
-use crate::auth::{expected_issuer, expected_subject, SmokeAuth};
+use crate::auth::{expected_identity_policy, expected_issuer, SmokeAuth};
 use crate::fixtures;
 use anyhow::{bail, Context, Result};
 use op_collab::{CollabMessage, Commit, Epoch, FrameEnvelope, Role};
@@ -53,7 +53,7 @@ pub fn accept_guest(
         &local_hello,
         owner_auth.verifier(),
         expected_issuer(),
-        expected_subject(),
+        expected_identity_policy(),
         owner_auth.now_unix_ms(),
         Instant::now(),
     )?;
@@ -82,7 +82,7 @@ pub fn connect_owner(
         &hello,
         guest_auth.verifier(),
         expected_issuer(),
-        expected_subject(),
+        expected_identity_policy(),
         guest_auth.now_unix_ms(),
         Instant::now(),
     )?;
diff --git a/crates/op-collab-smoke/src/guest.rs b/crates/op-collab-smoke/src/guest.rs
index 9a87c57fe..2a5b4b324 100644
--- a/crates/op-collab-smoke/src/guest.rs
+++ b/crates/op-collab-smoke/src/guest.rs
@@ -1,5 +1,5 @@
 use crate::auth::{
-    expected_issuer, expected_subject, SmokeAuth, GUEST_AVATAR_URL, GUEST_DEVICE_ID,
+    expected_identity_policy, expected_issuer, SmokeAuth, GUEST_AVATAR_URL, GUEST_DEVICE_ID,
     GUEST_DISPLAY_NAME, OWNER_AVATAR_URL, OWNER_DISPLAY_NAME,
 };
 use crate::fixtures;
@@ -34,7 +34,7 @@ pub fn run(address: SocketAddr) -> Result<String> {
         &hello,
         auth.verifier(),
         expected_issuer(),
-        expected_subject(),
+        expected_identity_policy(),
         auth.now_unix_ms(),
         Instant::now(),
     )?;
diff --git a/crates/op-collab-smoke/src/owner.rs b/crates/op-collab-smoke/src/owner.rs
index 8c30db1bb..2d429ff40 100644
--- a/crates/op-collab-smoke/src/owner.rs
+++ b/crates/op-collab-smoke/src/owner.rs
@@ -1,5 +1,5 @@
 use crate::auth::{
-    expected_issuer, expected_subject, SmokeAuth, GUEST_AVATAR_URL, GUEST_DISPLAY_NAME,
+    expected_identity_policy, expected_issuer, SmokeAuth, GUEST_AVATAR_URL, GUEST_DISPLAY_NAME,
     OWNER_AVATAR_URL, OWNER_DEVICE_ID, OWNER_DISPLAY_NAME,
 };
 use crate::fixtures;
@@ -84,7 +84,7 @@ fn serve(
         &local_hello,
         auth.verifier(),
         expected_issuer(),
-        expected_subject(),
+        expected_identity_policy(),
         auth.now_unix_ms(),
         Instant::now(),
     )?;