Attribute agent workflow dispatch

crates/disasmer-coordinator/src/lib.rs

@@ -473,6 +473,40 @@ impl Coordinator {
         Ok(record.clone())
     }
 
+    pub fn authorize_agent_project_run(
+        &self,
+        tenant: &TenantId,
+        project: &ProjectId,
+        agent: &AgentId,
+        public_key_fingerprint: &Digest,
+    ) -> Result<AgentPublicKeyRecord, CoordinatorError> {
+        let record = self
+            .durable
+            .agent_public_keys
+            .get(&(tenant.clone(), project.clone(), agent.clone()))
+            .ok_or_else(|| {
+                CoordinatorError::Unauthorized(
+                    "agent public key is not registered for this tenant/project".to_owned(),
+                )
+            })?;
+        if record.revoked {
+            return Err(CoordinatorError::Unauthorized(
+                "agent public key has been revoked".to_owned(),
+            ));
+        }
+        if &record.public_key_fingerprint != public_key_fingerprint {
+            return Err(CoordinatorError::Unauthorized(
+                "agent public key fingerprint does not match the registered key".to_owned(),
+            ));
+        }
+        if !record.scopes.iter().any(|scope| scope == "project:run") {
+            return Err(CoordinatorError::Unauthorized(
+                "agent public key is not scoped for project runs".to_owned(),
+            ));
+        }
+        Ok(record.clone())
+    }
+
     pub fn start_process(
         &mut self,
         tenant: TenantId,