From 9fa81fde9a556c538298138c1037352244b369bf Mon Sep 17 00:00:00 2001
From: Codex <codex@nodedc.local>
Date: Tue, 11 Aug 2026 01:12:30 +0300
Subject: [PATCH] test(device-manager): prove production file-token startup

---
 .../server/device-manager-server.test.mjs     | 47 ++++++++++++++++++-
 1 file changed, 46 insertions(+), 1 deletion(-)

diff --git a/apps/device-manager/server/device-manager-server.test.mjs b/apps/device-manager/server/device-manager-server.test.mjs
index 65d81c2..45296a4 100644
--- a/apps/device-manager/server/device-manager-server.test.mjs
+++ b/apps/device-manager/server/device-manager-server.test.mjs
@@ -1,9 +1,54 @@
 import assert from "node:assert/strict";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import test from "node:test";
 
 import { createLocalPreviewDeviceCore } from "./device-core-client.mjs";
 import { createDeviceManagerAuth } from "./device-manager-auth.mjs";
-import { createDeviceManagerServer } from "./device-manager-server.mjs";
+import {
+  createConfiguredDeviceManagerServer,
+  createDeviceManagerServer,
+} from "./device-manager-server.mjs";
+
+test("production configuration starts with runner-owned file tokens", async (t) => {
+  const root = await mkdtemp(join(tmpdir(), "nodedc-device-manager-production-"));
+  const launcherTokenFile = join(root, "launcher-token");
+  const coreTokenFile = join(root, "core-token");
+  await writeFile(launcherTokenFile, `${"a".repeat(48)}\n`, { mode: 0o640 });
+  await writeFile(coreTokenFile, `${"b".repeat(48)}\n`, { mode: 0o640 });
+  t.after(() => rm(root, { recursive: true, force: true }));
+
+  const server = await createConfiguredDeviceManagerServer({
+    env: {
+      NODE_ENV: "production",
+      NODEDC_DEVICE_MANAGER_AUTH_REQUIRED: "true",
+      NODEDC_DEVICE_MANAGER_COOKIE_SECURE: "true",
+      NODEDC_DEVICE_MANAGER_LOCAL_PREVIEW: "false",
+      NODEDC_DEVICE_MANAGER_SERVICE_SLUG: "device-core",
+      NODEDC_LAUNCHER_BASE_URL: "https://hub.nodedc.ru",
+      NODEDC_LAUNCHER_INTERNAL_URL: "http://launcher:5173",
+      NODEDC_LAUNCHER_INTERNAL_TOKEN_FILE: launcherTokenFile,
+      NODEDC_DEVICE_CORE_INTERNAL_URL: "http://device-control-core:18120",
+      NODEDC_DEVICE_CORE_TOKEN_FILE: coreTokenFile,
+    },
+  });
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", resolve);
+  });
+  t.after(() => new Promise((resolve) => server.close(resolve)));
+
+  const address = server.address();
+  const response = await fetch(`http://127.0.0.1:${address.port}/healthz`);
+  assert.equal(response.status, 200);
+  assert.deepEqual(await response.json(), {
+    ok: true,
+    service: "nodedc-device-manager",
+    authRequired: true,
+    deviceCoreConfigured: true,
+  });
+});
 
 test("Device Manager BFF exposes an empty, mutation-driven project workspace", async (t) => {
   const auth = createDeviceManagerAuth({