hscontrol: preserve stale GC timer coverage after ephemeral ownership changes

hscontrol/app.go

@@ -169,14 +169,6 @@ func NewHeadscale(cfg *types.Config) (*Headscale, error) {
 			return
 		}
 
-		// Re-registering with a permanent key cancels nothing, and the poll
-		// path only cancels for ephemeral nodes, so the old timer still fires.
-		if !node.IsEphemeral() {
-			log.Debug().Caller().EmbedObject(node).Msg("node is no longer ephemeral, skipping garbage collection")
-
-			return
-		}
-
 		// Schedule and Cancel run outside the session transition, so a
 		// disconnecting session can arm a timer after a reconnect already
 		// cancelled it. The session count is authoritative; a stale timer

hscontrol/poll_test.go

@@ -779,7 +779,7 @@ func TestEphemeralGCArmedWhenPolicyRefreshFails(t *testing.T) {
 }
 
 // TestEphemeralGCKeepsNodeReKeyedToPermanent pins that a timer armed while a
-// node was ephemeral does not delete it once a permanent key took over.
+// node was ephemeral does not delete it once a user claims the tagged node.
 func TestEphemeralGCKeepsNodeReKeyedToPermanent(t *testing.T) {
 	t.Parallel()
 
@@ -790,7 +790,10 @@ func TestEphemeralGCKeepsNodeReKeyedToPermanent(t *testing.T) {
 	app.StartEphemeralGCForTest(t)
 
 	user := app.state.CreateUserForTest("eph-gc-rekey-user")
-	ephemeralKey, err := app.state.CreatePreAuthKey(user.TypedID(), false, true, nil, nil)
+	require.NoError(t, app.state.UpdatePolicyManagerUsersForTest())
+	_, err := app.state.SetPolicy([]byte(`{"tagOwners":{"tag:server":["eph-gc-rekey-user@"]}}`))
+	require.NoError(t, err)
+	ephemeralKey, err := app.state.CreatePreAuthKey(user.TypedID(), false, true, nil, []string{"tag:server"})
 	require.NoError(t, err)
 	permanentKey, err := app.state.CreatePreAuthKey(user.TypedID(), false, false, nil, nil)
 	require.NoError(t, err)
@@ -799,6 +802,7 @@ func TestEphemeralGCKeepsNodeReKeyedToPermanent(t *testing.T) {
 	machineKey := key.NewMachine()
 
 	for _, authKey := range []string{ephemeralKey.Key, permanentKey.Key} {
+		nodeKey = key.NewNode()
 		_, err = app.handleRegister(context.Background(), tailcfg.RegisterRequest{
 			Auth: &tailcfg.RegisterResponseAuth{
 				AuthKey: authKey,