Validate agent callback envelopes

modules/work/domain/lease.go

@@ -9,6 +9,8 @@ import (
 
 var ErrLeaseRejected = errors.New("agent lease rejected")
 
+var ErrCallbackRejected = errors.New("agent callback rejected")
+
 func AcquireAgentLease(runID work.AgentRunID, workerID string, token work.AgentFencingToken, now time.Time, ttl time.Duration) (work.AgentLease, error) {
 	if runID == "" || workerID == "" || token == 0 || now.IsZero() || ttl <= 0 {
 		return work.AgentLease{}, ErrLeaseRejected
@@ -23,3 +25,10 @@ func RenewAgentLease(lease work.AgentLease, workerID string, token work.AgentFen
 	lease.ExpiresAt = now.Add(ttl)
 	return lease, nil
 }
+
+func ValidateAgentCallback(callback work.AgentCallback, lease work.AgentLease, lastSequence uint64) error {
+	if lease.State != work.AgentLeaseActive || callback.RunID == "" || callback.RunID != lease.RunID || callback.WorkerID == "" || callback.WorkerID != lease.WorkerID || callback.FencingToken == 0 || callback.FencingToken != lease.FencingToken || callback.Sequence <= lastSequence || callback.Kind == "" || callback.ObservedAt.IsZero() || !callback.ObservedAt.Before(lease.ExpiresAt) {
+		return ErrCallbackRejected
+	}
+	return nil
+}