feat(device-manager): add standalone project workspace

2026-08-13 11:37:36 +03:00
parent 6c1265b8b6
commit 4116f5ba95
17 changed files with 2584 additions and 0 deletions
@@ -0,0 +1,50 @@
+# NODE.DC Device Manager
+
+Standalone Device Core application shell for Hub-authenticated device administration.
+It is intentionally vendor-neutral: adapters and model profiles describe protocol-specific
+behavior; projects, inventory, collections and access remain shared Device Core concepts.
+
+## Runtime boundary
+
+- The browser talks only to the Device Manager BFF under `/api/device-manager/*`.
+- Launcher consumes the one-time handoff and periodically revalidates the process-local,
+  opaque Device Manager cookie.
+- The BFF derives the Core actor from that trusted Hub identity. Browser-supplied role,
+  group or owner headers are ignored.
+- The BFF reads the Core bearer token from `NODEDC_DEVICE_CORE_TOKEN_FILE`; the token is
+  never embedded into client assets or accepted as a raw environment value.
+- Device Control Core owns authorization, lifecycle validation, idempotency and persistence.
+- Query responses contain masked identifiers only. Digests and credential references stay
+  inside Device Control Core.
+
+Hub currently supplies identity and groups but no signed company-membership/owner-scope
+claim. Therefore an admin may create projects in their personal scope. Existing company
+projects remain visible through explicit project grants, but company project creation stays
+closed until Hub extends the handoff contract.
+
+## Local source preview
+
+The preview store starts empty and exists only to exercise the shell without a deployed Core.
+All visible resources must still be created through the same command-shaped BFF endpoints.
+It is forbidden when `NODE_ENV=production`.
+
+```sh
+NODEDC_DEVICE_MANAGER_LOCAL_PREVIEW=1 \
+NODEDC_DEVICE_MANAGER_AUTH_REQUIRED=0 \
+npm run build --workspace @nodedc/device-manager
+
+NODEDC_DEVICE_MANAGER_LOCAL_PREVIEW=1 \
+NODEDC_DEVICE_MANAGER_AUTH_REQUIRED=0 \
+npm run serve --workspace @nodedc/device-manager
+```
+
+Production additionally requires:
+
+- `NODEDC_LAUNCHER_BASE_URL`
+- `NODEDC_LAUNCHER_INTERNAL_URL`
+- `NODEDC_INTERNAL_ACCESS_TOKEN` or `NODEDC_PLATFORM_SERVICE_TOKEN`
+- `NODEDC_DEVICE_CORE_INTERNAL_URL`
+- `NODEDC_DEVICE_CORE_TOKEN_FILE`
+
+The application source does not create a Hub service entry, DNS record, reverse proxy,
+database or deployment artifact. Those remain explicit infrastructure phases.