feat(device-manager): add safe device enrollment

apps/device-manager/server/device-core-client.test.mjs

@@ -122,7 +122,7 @@ test("local preview is empty and creates resources only through canonical comman
     deploymentRef: "deployment:preview-edge",
     lifecycleState: "provisioning",
   });
-  await client.execute("routes:ensure", actor, {
+  const route = await client.execute("routes:ensure", actor, {
     projectRef,
     routeKey: "preview-route",
     displayName: "Preview route",
@@ -133,6 +133,56 @@ test("local preview is empty and creates resources only through canonical comman
     direction: "telemetry",
     lifecycleState: "draft",
   });
+  await client.execute("adapter-versions:register", platformActor, {
+    adapterPackageRef: adapterPackage.result.adapterPackage.adapterPackageRef,
+    version: "1.0.0",
+    runtimePackageRef: "artifact:generic-tracker:1.0.0",
+    contentDigest: `sha256:${"a".repeat(64)}`,
+    contractVersion: "device-adapter.v1",
+    capabilities: ["telemetry"],
+    lifecycleState: "active",
+  });
+  await client.execute("model-profiles:register", platformActor, {
+    adapterVersionRef: adapterVersion.result.adapterVersion.adapterVersionRef,
+    profileRef: "generic.tracker.v1",
+    schemaVersion: "1.0.0",
+    vendor: "Generic",
+    model: "Tracker",
+    deviceType: "tracker",
+    protocol: "INTERNAL",
+    schemaArtifactRef: "schema:generic.tracker.v1",
+    profileDigest: `sha256:${"b".repeat(64)}`,
+    capabilities: ["telemetry"],
+    lifecycleState: "active",
+  });
+  await client.execute("edges:ensure", platformActor, {
+    edgeKey: "preview-edge",
+    displayName: "Preview Edge",
+    deploymentRef: "deployment:preview-edge",
+    lifecycleState: "active",
+  });
+  await client.execute("routes:ensure", actor, {
+    projectRef,
+    routeKey: "preview-route",
+    displayName: "Preview route",
+    edgeRef: edge.result.edge.edgeRef,
+    modelProfileRef: modelProfile.result.modelProfile.modelProfileRef,
+    listenerRef: "listener:preview",
+    protocol: "INTERNAL",
+    direction: "telemetry",
+    lifecycleState: "active",
+  });
+  const enrollment = await client.execute("enrollment-intents:ensure", actor, {
+    projectRef,
+    enrollmentKey: "preview-device",
+    routeRef: route.result.route.routeRef,
+    modelProfileRef: modelProfile.result.modelProfile.modelProfileRef,
+    displayName: "Preview device",
+    identifier: { kind: "imei", value: "123456789012345" },
+    expiresAt: null,
+  });
+  assert.equal(enrollment.result.enrollmentIntent.identifier.masked, "***********2345");
+  assert.equal(JSON.stringify(enrollment).includes("123456789012345"), false);
   const collectionRef = (await client.getWorkspace(actor, projectRef))
     .collections[0].collectionRef;
   await client.execute("device-bindings:ensure", actor, {
@@ -161,6 +211,8 @@ test("local preview is empty and creates resources only through canonical comman
   assert.equal(workspace.collections[0].collectionKey, "field-devices");
   assert.equal(workspace.adapterPackages[0].packageKey, "generic-tracker");
   assert.equal(workspace.routes[0].routeKey, "preview-route");
+  assert.equal(workspace.routes[0].lifecycleState, "active");
+  assert.equal(workspace.enrollments[0].expectedIdentifier.masked, "***********2345");
   assert.equal(workspace.bindings[0].lifecycleState, "pending_external_approval");
   assert.equal(workspace.grants.length, 2);
   assert.ok(workspace.auditEvents.some((event) => event.eventType === "device_binding.created"));