feat(gateway): fetch sealed Apollo session work

gateway/transport.go

@@ -33,6 +33,7 @@ var (
 
 type Admission interface {
 	Admit(context.Context, protocol.TunnelAdmissionRequest) (protocol.SessionAuthority, error)
+	ProviderWork(context.Context, protocol.SessionAuthority) (protocol.ProviderSessionWork, error)
 	Release(context.Context, protocol.SessionAuthority) error
 }
 
@@ -44,6 +45,10 @@ func (f AdmissionFunc) Admit(ctx context.Context, request protocol.TunnelAdmissi
 
 func (AdmissionFunc) Release(context.Context, protocol.SessionAuthority) error { return nil }
 
+func (AdmissionFunc) ProviderWork(context.Context, protocol.SessionAuthority) (protocol.ProviderSessionWork, error) {
+	return protocol.ProviderSessionWork{}, ErrAdmissionRejected
+}
+
 type ProviderStateReporter interface {
 	ReportProviderState(context.Context, protocol.ProviderState) error
 }
@@ -210,6 +215,12 @@ func (s *Server) handleConnection(parent context.Context, connection *quic.Conn)
 		_ = writeStableError(stream, "invalid_authority", err, false)
 		return
 	}
+	work, err := s.config.Admission.ProviderWork(ctx, authority)
+	if err != nil || s.validateProviderWork(work, authority) != nil {
+		_ = s.config.Admission.Release(context.Background(), authority)
+		_ = writeStableError(stream, "provider_work_unavailable", ErrAdmissionRejected, err != nil)
+		return
+	}
 	selected, err := IntersectCapabilities(s.config.Capabilities, s.config.ProviderCapabilities, request.Capabilities, authority.Capabilities)
 	if err != nil {
 		_ = s.config.Admission.Release(context.Background(), authority)
@@ -222,7 +233,7 @@ func (s *Server) handleConnection(parent context.Context, connection *quic.Conn)
 		_ = writeStableError(stream, "provider_state_unavailable", err, true)
 		return
 	}
-	providerSession, err := s.config.Provider.Start(ctx, LaunchRequest{SessionID: request.SessionID, Capabilities: selected, ProviderProfile: authority.ProviderProfile, ProviderIdentity: authority.ProviderIdentity})
+	providerSession, err := s.config.Provider.Start(ctx, LaunchRequest{SessionID: request.SessionID, Capabilities: selected, ProviderProfile: authority.ProviderProfile, ProviderIdentity: work.ProviderIdentity, ProviderWork: work})
 	if err != nil {
 		s.metrics.ProviderErrors.Add(1)
 		_ = s.reportProviderState(context.Background(), protocol.ProviderState{Version: "1", SessionID: request.SessionID, State: ProviderStateFailed, CleanupPending: false, Channels: []string{"video", "audio", "input", "feedback"}})
@@ -279,6 +290,18 @@ func (s *Server) validateAuthority(authority protocol.SessionAuthority, request
 	return nil
 }
 
+func (s *Server) validateProviderWork(work protocol.ProviderSessionWork, authority protocol.SessionAuthority) error {
+	if err := work.Validate(); err != nil {
+		return err
+	}
+	if work.SessionID != authority.SessionID || work.GatewayID != authority.GatewayID ||
+		work.ReconnectSequence != authority.ReconnectSequence || work.ExpiresAt != authority.ExpiresAt ||
+		work.ProviderProfile != authority.ProviderProfile {
+		return ErrAdmissionRejected
+	}
+	return nil
+}
+
 func (s *Server) addSession(session *gatewaySession) {
 	s.mu.Lock()
 	s.sessions[session] = struct{}{}