delete agent flow

wakey-control-plane/src/api/control.rs

@@ -50,6 +50,12 @@ pub struct RevokeEnrollTokenResponse {
     pub revoked: bool,
 }
 
+#[derive(Debug, Serialize, Deserialize)]
+pub struct RevokeAgentResponse {
+    pub agent_id: String,
+    pub revoked: bool,
+}
+
 #[derive(Debug, Serialize, Deserialize)]
 pub struct StateStatsResponse {
     pub db_path: String,
@@ -275,6 +281,56 @@ pub async fn revoke_enroll_token(
     }
 }
 
+pub async fn revoke_agent(
+    State(state): State<AppState>,
+    AxumPath(agent_id): AxumPath<String>,
+) -> Result<impl IntoResponse, (StatusCode, Json<serde_json::Value>)> {
+    match state.store.revoke_agent(&agent_id).await {
+        Ok(revoked) => {
+            if revoked {
+                // Remove any active session so this credential is also cut off at runtime.
+                state.sessions.write().await.remove(&agent_id);
+            }
+
+            if let Err(err) = state
+                .store
+                .append_audit_event(AuditEventInput {
+                    actor_type: "admin_api".into(),
+                    actor_id: None,
+                    agent_id: Some(agent_id.clone()),
+                    request_id: None,
+                    event_type: "agent_revoke".into(),
+                    outcome: if revoked {
+                        "ok".into()
+                    } else {
+                        "not_found".into()
+                    },
+                    latency_ms: None,
+                    message: if revoked {
+                        "revoked agent credentials".into()
+                    } else {
+                        "agent credentials not found".into()
+                    },
+                    metadata: serde_json::json!({ "agent_id": agent_id }),
+                })
+                .await
+            {
+                warn!(error = %err, "failed to append audit event for agent revoke");
+            }
+
+            Ok((StatusCode::OK, Json(RevokeAgentResponse { agent_id, revoked })))
+        }
+        Err(err) => {
+            warn!(error = %err, "failed to revoke agent credentials");
+            Err(json_error(
+                StatusCode::INTERNAL_SERVER_ERROR,
+                "revoke_agent_failed",
+                &err.to_string(),
+            ))
+        }
+    }
+}
+
 pub async fn state_stats(
     State(state): State<AppState>,
 ) -> Result<impl IntoResponse, (StatusCode, Json<serde_json::Value>)> {

wakey-control-plane/src/api/mod.rs

@@ -10,8 +10,9 @@ pub use alerts::{active_alerts, alert_history, alerts_stream};
 pub use audit::list_audit_events;
 pub use commands::{list_agents, run_command};
 pub use control::{
-    EnrollTokenStatus, IssueEnrollTokenResponse, RevokeEnrollTokenResponse, StateStatsResponse,
-    enroll, healthz, issue_enroll_token, list_enroll_tokens, revoke_enroll_token, state_stats,
+    EnrollTokenStatus, IssueEnrollTokenResponse, RevokeAgentResponse, RevokeEnrollTokenResponse,
+    StateStatsResponse, enroll, healthz, issue_enroll_token, list_enroll_tokens, revoke_agent,
+    revoke_enroll_token, state_stats,
 };
 
 pub fn json_error(