Add resource-scoped bearer access metadata

crates/geth/tests/bootstrap.rs

@@ -667,6 +667,73 @@ fn secret_create_rotate_and_status_track_resource_epochs() {
     );
 }
 
+#[test]
+fn bearer_access_create_list_revoke_uses_resource_scoped_auth_ops() {
+    let home = tempfile::tempdir().expect("tempdir");
+    let paths = geth_config::GethPaths::from_home(home.path());
+    let node = geth_node::init_node(&paths).expect("init node");
+
+    let response = geth_node::handle_request(
+        &node,
+        geth_control::ControlRequest::SecretBearerCreate {
+            resource: "resource:cas:local".to_owned(),
+            capabilities: vec!["cas.fetch".to_owned(), "cas.pin".to_owned()],
+            expires_at_ms: Some(1234),
+        },
+    )
+    .expect("create bearer");
+    let secret = match response {
+        geth_control::ControlResponse::SecretBearerCreated { access } => {
+            assert_eq!(access.resource.to_string(), "resource:cas:local");
+            assert_eq!(access.capabilities.len(), 2);
+            assert_eq!(access.expires_at.map(|expires_at| expires_at.0), Some(1234));
+            assert!(!access.may_delegate);
+            access.secret.to_string()
+        }
+        other => panic!("unexpected response: {other:?}"),
+    };
+
+    let response = geth_node::handle_request(&node, geth_control::ControlRequest::SecretBearerList)
+        .expect("list bearer");
+    match response {
+        geth_control::ControlResponse::SecretBearerList { access } => {
+            assert_eq!(access.len(), 1);
+            assert_eq!(access[0].secret.to_string(), secret);
+            assert!(!access[0].may_delegate);
+        }
+        other => panic!("unexpected response: {other:?}"),
+    }
+
+    geth_node::handle_request(
+        &node,
+        geth_control::ControlRequest::SecretBearerRevoke {
+            resource: "resource:cas:local".to_owned(),
+            secret: secret.clone(),
+        },
+    )
+    .expect("revoke bearer");
+    let response = geth_node::handle_request(&node, geth_control::ControlRequest::SecretBearerList)
+        .expect("list revoked bearer");
+    match response {
+        geth_control::ControlResponse::SecretBearerList { access } => {
+            assert!(access.is_empty());
+        }
+        other => panic!("unexpected response: {other:?}"),
+    }
+
+    assert!(
+        geth_node::handle_request(
+            &node,
+            geth_control::ControlRequest::SecretBearerCreate {
+                resource: "resource:cas:local".to_owned(),
+                capabilities: vec!["auth.delegate".to_owned()],
+                expires_at_ms: None,
+            },
+        )
+        .is_err()
+    );
+}
+
 #[test]
 fn ssh_cert_request_approval_and_revocation_export_use_local_state() {
     let home = tempfile::tempdir().expect("tempdir");