537 lines
20 KiB
JavaScript
537 lines
20 KiB
JavaScript
import { randomUUID } from "node:crypto";
|
|
|
|
const commandRoutes = new Map([
|
|
["owner-scopes:ensure", "/internal/v1/management/owner-scopes:ensure"],
|
|
["projects:ensure", "/internal/v1/management/projects:ensure"],
|
|
["collections:ensure", "/internal/v1/management/collections:ensure"],
|
|
["project-grants:upsert", "/internal/v1/management/project-grants:upsert"],
|
|
["adapter-packages:ensure", "/internal/v1/management/adapter-packages:ensure"],
|
|
["adapter-versions:register", "/internal/v1/management/adapter-versions:register"],
|
|
["model-profiles:register", "/internal/v1/management/model-profiles:register"],
|
|
["edges:ensure", "/internal/v1/management/edges:ensure"],
|
|
["routes:ensure", "/internal/v1/management/routes:ensure"],
|
|
["enrollment-intents:ensure", "/internal/v1/management/enrollment-intents:ensure"],
|
|
["devices:claim", "/internal/v1/management/devices:claim"],
|
|
["device-bindings:ensure", "/internal/v1/management/device-bindings:ensure"],
|
|
["device-bindings:revoke", "/internal/v1/management/device-bindings:revoke"],
|
|
[
|
|
"device-configuration-revisions:create",
|
|
"/internal/v1/management/device-configuration-revisions:create",
|
|
],
|
|
[
|
|
"device-configurations:set-desired",
|
|
"/internal/v1/management/device-configurations:set-desired",
|
|
],
|
|
]);
|
|
|
|
export function createDeviceCoreClient({ baseUrl, token, fetchImpl = fetch } = {}) {
|
|
const endpoint = normalizeBaseUrl(baseUrl);
|
|
if (typeof token !== "string" || token.length < 32) {
|
|
throw serviceError("device_core_token_invalid", 503);
|
|
}
|
|
|
|
async function request(pathname, actor, init = {}) {
|
|
const response = await fetchImpl(new URL(pathname, endpoint), {
|
|
...init,
|
|
headers: {
|
|
Accept: "application/json",
|
|
Authorization: `Bearer ${token}`,
|
|
...actorHeaders(actor),
|
|
...(init.headers ?? {}),
|
|
},
|
|
signal: AbortSignal.timeout(10_000),
|
|
});
|
|
const body = await response.json().catch(() => null);
|
|
if (!response.ok || body?.ok !== true) {
|
|
throw serviceError(
|
|
safeCoreError(body?.error),
|
|
response.status >= 400 && response.status < 600 ? response.status : 502,
|
|
);
|
|
}
|
|
return body;
|
|
}
|
|
|
|
return {
|
|
configured: true,
|
|
async listProjects(actor) {
|
|
return request("/internal/v1/query/projects", actor)
|
|
.then((body) => body.projects);
|
|
},
|
|
async getWorkspace(actor, projectRef) {
|
|
const projectId = entityId(projectRef, "project");
|
|
return request(`/internal/v1/query/projects/${projectId}/workspace`, actor)
|
|
.then((body) => body.workspace);
|
|
},
|
|
async execute(command, actor, input, idempotencyKey) {
|
|
const pathname = commandRoutes.get(command);
|
|
if (!pathname) throw serviceError("device_manager_command_invalid", 404);
|
|
if (!/^[\x21-\x7e]{8,256}$/.test(idempotencyKey || "")) {
|
|
throw serviceError("device_idempotency_key_invalid", 400);
|
|
}
|
|
return request(pathname, actor, {
|
|
method: "POST",
|
|
headers: {
|
|
"Content-Type": "application/json",
|
|
"Idempotency-Key": idempotencyKey,
|
|
},
|
|
body: JSON.stringify(input),
|
|
}).then(({ replayed, result }) => ({ replayed, result }));
|
|
},
|
|
};
|
|
}
|
|
|
|
export function createLocalPreviewDeviceCore() {
|
|
const ownerScopes = new Map();
|
|
const projects = new Map();
|
|
const collections = new Map();
|
|
const adapterPackages = new Map();
|
|
const adapterVersions = new Map();
|
|
const modelProfiles = new Map();
|
|
const edges = new Map();
|
|
const routes = new Map();
|
|
const bindings = new Map();
|
|
const grants = new Map();
|
|
const configurationRevisions = new Map();
|
|
const configurationStates = new Map();
|
|
const auditEvents = [];
|
|
|
|
function now() {
|
|
return new Date().toISOString();
|
|
}
|
|
|
|
function projectValues(store, projectRef) {
|
|
return [...store.values()].filter((value) => value.projectRef === projectRef);
|
|
}
|
|
|
|
function audit(actor, projectRef, eventType, refs = {}) {
|
|
auditEvents.unshift({
|
|
auditEventRef: `audit-event:${randomUUID()}`,
|
|
eventType,
|
|
actorRef: actor.userRef,
|
|
deviceRef: refs.deviceRef ?? null,
|
|
discoveryRef: refs.discoveryRef ?? null,
|
|
projectRef,
|
|
occurredAt: now(),
|
|
});
|
|
}
|
|
|
|
function projectSummary(project) {
|
|
const projectCollections = [...collections.values()]
|
|
.filter((collection) => collection.projectRef === project.projectRef);
|
|
return {
|
|
...project,
|
|
counts: { devices: 0, collections: projectCollections.length, discoveries: 0 },
|
|
};
|
|
}
|
|
|
|
function workspace(projectRef) {
|
|
const project = projects.get(projectRef);
|
|
if (!project) throw serviceError("device_project_not_found", 404);
|
|
return {
|
|
project: projectSummary(project),
|
|
devices: [],
|
|
discoveries: [],
|
|
enrollments: [],
|
|
collections: projectValues(collections, projectRef)
|
|
.map(({ projectRef: _projectRef, ...collection }) => collection),
|
|
adapterPackages: [...adapterPackages.values()],
|
|
adapterVersions: [...adapterVersions.values()],
|
|
modelProfiles: [...modelProfiles.values()],
|
|
edges: [...edges.values()],
|
|
routes: projectValues(routes, projectRef),
|
|
sessions: [],
|
|
bindings: projectValues(bindings, projectRef),
|
|
configurationRevisions: projectValues(configurationRevisions, projectRef),
|
|
configurationStates: projectValues(configurationStates, projectRef),
|
|
commands: [],
|
|
auditEvents: auditEvents.filter((event) => event.projectRef === projectRef),
|
|
grants: projectValues(grants, projectRef),
|
|
policies: {
|
|
commandTransport: "disabled",
|
|
commandPlanningApi: "disabled",
|
|
identifierProjection: "masked-only",
|
|
auditPayloadProjection: "metadata-only",
|
|
},
|
|
};
|
|
}
|
|
|
|
return {
|
|
configured: true,
|
|
async listProjects() {
|
|
return [...projects.values()].map(projectSummary);
|
|
},
|
|
async getWorkspace(_actor, projectRef) {
|
|
return workspace(projectRef);
|
|
},
|
|
async execute(command, actor, input) {
|
|
if (command === "owner-scopes:ensure") {
|
|
const key = `${input.scopeKind}:${input.ownerRef}`;
|
|
const created = !ownerScopes.has(key);
|
|
const scope = {
|
|
ownerScopeRef: ownerScopes.get(key)?.ownerScopeRef || `owner-scope:${randomUUID()}`,
|
|
scopeKind: input.scopeKind,
|
|
ownerRef: input.ownerRef,
|
|
displayName: input.displayName,
|
|
lifecycleState: "active",
|
|
};
|
|
ownerScopes.set(key, scope);
|
|
return { replayed: false, result: { created, ownerScope: scope } };
|
|
}
|
|
if (command === "projects:ensure") {
|
|
const scope = ownerScopes.get(`${input.scopeKind}:${input.ownerRef}`);
|
|
if (!scope) throw serviceError("device_owner_scope_not_found", 404);
|
|
const existing = [...projects.values()].find((project) =>
|
|
project.ownerScope.ownerRef === input.ownerRef
|
|
&& project.projectKey === input.projectKey
|
|
);
|
|
const projectRef = existing?.projectRef || `project:${randomUUID()}`;
|
|
const project = {
|
|
projectRef,
|
|
projectKey: input.projectKey,
|
|
name: input.name,
|
|
description: input.description ?? null,
|
|
lifecycleState: "active",
|
|
ownerScope: scope,
|
|
access: { projectRole: "owner", capabilities: ownerCapabilities },
|
|
counts: { devices: 0, collections: 0, discoveries: 0 },
|
|
createdAt: existing?.createdAt || new Date().toISOString(),
|
|
updatedAt: new Date().toISOString(),
|
|
};
|
|
projects.set(projectRef, project);
|
|
if (!existing) {
|
|
const grantRef = `grant:${randomUUID()}`;
|
|
grants.set(grantRef, {
|
|
grantRef,
|
|
projectRef,
|
|
principalKind: "user",
|
|
principalRef: actor.userRef,
|
|
projectRole: "owner",
|
|
capabilityAllow: [],
|
|
capabilityDeny: [],
|
|
lifecycleState: "active",
|
|
});
|
|
audit(actor, projectRef, "project.created");
|
|
}
|
|
return { replayed: false, result: { created: !existing, project } };
|
|
}
|
|
if (command === "collections:ensure") {
|
|
const projectRef = input.projectRef;
|
|
if (!projects.has(projectRef)) throw serviceError("device_project_not_found", 404);
|
|
const existing = [...collections.values()].find((collection) =>
|
|
collection.projectRef === projectRef
|
|
&& collection.collectionKey === input.collectionKey
|
|
);
|
|
const collectionRef = existing?.collectionRef || `collection:${randomUUID()}`;
|
|
const collection = {
|
|
collectionRef,
|
|
projectRef,
|
|
collectionKey: input.collectionKey,
|
|
name: input.name,
|
|
description: input.description ?? null,
|
|
lifecycleState: "active",
|
|
memberCount: existing?.memberCount || 0,
|
|
createdAt: existing?.createdAt || new Date().toISOString(),
|
|
updatedAt: new Date().toISOString(),
|
|
};
|
|
collections.set(collectionRef, collection);
|
|
audit(actor, projectRef, createdEvent(existing, "collection"));
|
|
return { replayed: false, result: { created: !existing, collection } };
|
|
}
|
|
if (command === "project-grants:upsert") {
|
|
if (!projects.has(input.projectRef)) {
|
|
throw serviceError("device_project_not_found", 404);
|
|
}
|
|
const existing = [...grants.values()].find((grant) =>
|
|
grant.projectRef === input.projectRef
|
|
&& grant.principalKind === input.principalKind
|
|
&& grant.principalRef === input.principalRef
|
|
);
|
|
const grantRef = existing?.grantRef || `grant:${randomUUID()}`;
|
|
const grant = {
|
|
grantRef,
|
|
projectRef: input.projectRef,
|
|
principalKind: input.principalKind,
|
|
principalRef: input.principalRef,
|
|
projectRole: input.projectRole,
|
|
capabilityAllow: input.capabilityAllow ?? [],
|
|
capabilityDeny: input.capabilityDeny ?? [],
|
|
lifecycleState: input.lifecycleState ?? "active",
|
|
};
|
|
grants.set(grantRef, grant);
|
|
audit(actor, input.projectRef, createdEvent(existing, "project_grant"));
|
|
return { replayed: false, result: { created: !existing, grant } };
|
|
}
|
|
if (command === "adapter-packages:ensure") {
|
|
requirePlatformOwner(actor);
|
|
const existing = [...adapterPackages.values()].find(
|
|
(entry) => entry.packageKey === input.packageKey,
|
|
);
|
|
const adapterPackageRef = existing?.adapterPackageRef
|
|
|| `adapter-package:${randomUUID()}`;
|
|
const adapterPackage = {
|
|
adapterPackageRef,
|
|
packageKey: input.packageKey,
|
|
displayName: input.displayName,
|
|
publisherRef: input.publisherRef,
|
|
lifecycleState: input.lifecycleState ?? "active",
|
|
createdAt: existing?.createdAt || now(),
|
|
updatedAt: now(),
|
|
};
|
|
adapterPackages.set(adapterPackageRef, adapterPackage);
|
|
return { replayed: false, result: { created: !existing, adapterPackage } };
|
|
}
|
|
if (command === "adapter-versions:register") {
|
|
requirePlatformOwner(actor);
|
|
if (!adapterPackages.has(input.adapterPackageRef)) {
|
|
throw serviceError("device_adapter_package_not_found", 404);
|
|
}
|
|
const existing = [...adapterVersions.values()].find((entry) =>
|
|
entry.adapterPackageRef === input.adapterPackageRef
|
|
&& entry.version === input.version
|
|
);
|
|
const adapterVersionRef = existing?.adapterVersionRef
|
|
|| `adapter-version:${randomUUID()}`;
|
|
const adapterVersion = {
|
|
adapterVersionRef,
|
|
adapterPackageRef: input.adapterPackageRef,
|
|
version: input.version,
|
|
runtimePackageRef: input.runtimePackageRef,
|
|
contentDigest: input.contentDigest,
|
|
contractVersion: input.contractVersion,
|
|
capabilities: input.capabilities ?? [],
|
|
lifecycleState: input.lifecycleState ?? "draft",
|
|
createdAt: existing?.createdAt || now(),
|
|
updatedAt: now(),
|
|
};
|
|
adapterVersions.set(adapterVersionRef, adapterVersion);
|
|
return { replayed: false, result: { created: !existing, adapterVersion } };
|
|
}
|
|
if (command === "model-profiles:register") {
|
|
requirePlatformOwner(actor);
|
|
if (!adapterVersions.has(input.adapterVersionRef)) {
|
|
throw serviceError("device_adapter_version_not_found", 404);
|
|
}
|
|
const existing = modelProfiles.get(input.profileRef);
|
|
const modelProfile = {
|
|
modelProfileRef: input.profileRef,
|
|
adapterVersionRef: input.adapterVersionRef,
|
|
schemaVersion: input.schemaVersion,
|
|
vendor: input.vendor,
|
|
model: input.model,
|
|
deviceType: input.deviceType,
|
|
protocol: input.protocol,
|
|
schemaArtifactRef: input.schemaArtifactRef,
|
|
profileDigest: input.profileDigest,
|
|
capabilities: input.capabilities ?? [],
|
|
lifecycleState: input.lifecycleState ?? "draft",
|
|
createdAt: existing?.createdAt || now(),
|
|
updatedAt: now(),
|
|
};
|
|
modelProfiles.set(input.profileRef, modelProfile);
|
|
return { replayed: false, result: { created: !existing, modelProfile } };
|
|
}
|
|
if (command === "edges:ensure") {
|
|
requirePlatformOwner(actor);
|
|
const existing = [...edges.values()].find(
|
|
(entry) => entry.edgeKey === input.edgeKey,
|
|
);
|
|
const edgeRef = existing?.edgeRef || `edge:${randomUUID()}`;
|
|
const edge = {
|
|
edgeRef,
|
|
edgeKey: input.edgeKey,
|
|
displayName: input.displayName,
|
|
deploymentRef: input.deploymentRef ?? null,
|
|
lifecycleState: input.lifecycleState ?? "provisioning",
|
|
createdAt: existing?.createdAt || now(),
|
|
updatedAt: now(),
|
|
};
|
|
edges.set(edgeRef, edge);
|
|
return { replayed: false, result: { created: !existing, edge } };
|
|
}
|
|
if (command === "routes:ensure") {
|
|
if (!projects.has(input.projectRef)) {
|
|
throw serviceError("device_project_not_found", 404);
|
|
}
|
|
const edge = edges.get(input.edgeRef);
|
|
const profile = modelProfiles.get(input.modelProfileRef);
|
|
if (!edge) throw serviceError("device_edge_not_found", 404);
|
|
if (!profile) throw serviceError("device_model_profile_not_found", 404);
|
|
const existing = projectValues(routes, input.projectRef).find(
|
|
(entry) => entry.routeKey === input.routeKey,
|
|
);
|
|
const routeRef = existing?.routeRef || `route:${randomUUID()}`;
|
|
const route = {
|
|
routeRef,
|
|
projectRef: input.projectRef,
|
|
routeKey: input.routeKey,
|
|
displayName: input.displayName,
|
|
edgeRef: input.edgeRef,
|
|
edgeName: edge.displayName,
|
|
modelProfileRef: input.modelProfileRef,
|
|
profileName: `${profile.vendor} ${profile.model}`,
|
|
listenerRef: input.listenerRef,
|
|
protocol: input.protocol,
|
|
direction: input.direction ?? "telemetry",
|
|
lifecycleState: input.lifecycleState ?? "draft",
|
|
sessionCount: 0,
|
|
activeSessionCount: 0,
|
|
createdAt: existing?.createdAt || now(),
|
|
updatedAt: now(),
|
|
};
|
|
routes.set(routeRef, route);
|
|
audit(actor, input.projectRef, createdEvent(existing, "route"));
|
|
return { replayed: false, result: { created: !existing, route } };
|
|
}
|
|
if (command === "device-bindings:ensure") {
|
|
if (!projects.has(input.projectRef)) {
|
|
throw serviceError("device_project_not_found", 404);
|
|
}
|
|
if (input.source?.kind !== "collection" || !collections.has(input.source.ref)) {
|
|
throw serviceError("device_binding_source_not_found", 404);
|
|
}
|
|
const existing = projectValues(bindings, input.projectRef).find(
|
|
(entry) => entry.bindingKey === input.bindingKey,
|
|
);
|
|
const bindingRef = existing?.bindingRef || `binding:${randomUUID()}`;
|
|
const source = collections.get(input.source.ref);
|
|
const binding = {
|
|
bindingRef,
|
|
projectRef: input.projectRef,
|
|
bindingKey: input.bindingKey,
|
|
displayName: input.displayName,
|
|
source: {
|
|
kind: input.source.kind,
|
|
ref: input.source.ref,
|
|
displayName: source.name,
|
|
},
|
|
target: { kind: input.targetKind, ref: input.targetRef },
|
|
capabilities: input.capabilities,
|
|
lifecycleState: "pending_external_approval",
|
|
sourceApprovedAt: now(),
|
|
createdAt: existing?.createdAt || now(),
|
|
updatedAt: now(),
|
|
};
|
|
bindings.set(bindingRef, binding);
|
|
audit(actor, input.projectRef, createdEvent(existing, "device_binding"));
|
|
return { replayed: false, result: { created: !existing, binding } };
|
|
}
|
|
if (command === "device-bindings:revoke") {
|
|
const binding = bindings.get(input.bindingRef);
|
|
if (!binding || binding.projectRef !== input.projectRef) {
|
|
throw serviceError("device_binding_not_found", 404);
|
|
}
|
|
const revoked = { ...binding, lifecycleState: "revoked", updatedAt: now() };
|
|
bindings.set(binding.bindingRef, revoked);
|
|
audit(actor, input.projectRef, "device_binding.revoked");
|
|
return { replayed: false, result: { revoked: true, binding: revoked } };
|
|
}
|
|
if (command === "device-configuration-revisions:create") {
|
|
throw serviceError("device_not_found", 404);
|
|
}
|
|
if (command === "device-configurations:set-desired") {
|
|
throw serviceError("device_configuration_revision_not_found", 404);
|
|
}
|
|
if (command === "enrollment-intents:ensure") {
|
|
throw serviceError("device_enrollment_secure_input_required", 409);
|
|
}
|
|
if (command === "devices:claim") {
|
|
throw serviceError("device_discovery_not_found", 404);
|
|
}
|
|
throw serviceError("device_manager_command_invalid", 404);
|
|
},
|
|
snapshot() {
|
|
return {
|
|
ownerScopes,
|
|
projects,
|
|
collections,
|
|
adapterPackages,
|
|
adapterVersions,
|
|
modelProfiles,
|
|
edges,
|
|
routes,
|
|
bindings,
|
|
grants,
|
|
configurationRevisions,
|
|
configurationStates,
|
|
auditEvents,
|
|
};
|
|
},
|
|
};
|
|
}
|
|
|
|
function createdEvent(existing, resource) {
|
|
return `${resource}.${existing ? "updated" : "created"}`;
|
|
}
|
|
|
|
function requirePlatformOwner(actor) {
|
|
if (actor?.hubRole !== "owner") {
|
|
throw serviceError("device_platform_catalog_access_denied", 403);
|
|
}
|
|
}
|
|
|
|
const ownerCapabilities = Object.freeze([
|
|
"project.read",
|
|
"project.manage",
|
|
"access.manage",
|
|
"inventory.read",
|
|
"device.enroll",
|
|
"device.claim",
|
|
"device.transfer",
|
|
"collection.manage",
|
|
"route.manage",
|
|
"binding.manage",
|
|
"telemetry.observe",
|
|
"configuration.read",
|
|
"configuration.manage",
|
|
"command.plan",
|
|
"command.confirm",
|
|
"command.dispatch",
|
|
"credential.manage",
|
|
"audit.read",
|
|
]);
|
|
|
|
function actorHeaders(actor) {
|
|
if (!actor || typeof actor !== "object") throw serviceError("device_actor_required", 401);
|
|
return {
|
|
"X-NODEDC-User-Ref": actor.userRef,
|
|
"X-NODEDC-Hub-Role": actor.hubRole,
|
|
"X-NODEDC-Group-Refs": (actor.groupRefs ?? []).join(","),
|
|
"X-NODEDC-Owner-Scopes": (actor.ownerScopes ?? [])
|
|
.map((scope) => `${scope.scopeKind}=${scope.ownerRef}`)
|
|
.join(","),
|
|
};
|
|
}
|
|
|
|
function entityId(value, prefix) {
|
|
const match = String(value || "").match(new RegExp(
|
|
`^${prefix}:([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})$`,
|
|
"i",
|
|
));
|
|
if (!match) throw serviceError(`device_${prefix}_ref_invalid`, 400);
|
|
return match[1].toLowerCase();
|
|
}
|
|
|
|
function normalizeBaseUrl(value) {
|
|
if (typeof value !== "string" || value.trim() === "") {
|
|
throw serviceError("device_core_url_required", 503);
|
|
}
|
|
const url = new URL(value);
|
|
if (!["http:", "https:"].includes(url.protocol) || url.username || url.password) {
|
|
throw serviceError("device_core_url_invalid", 503);
|
|
}
|
|
url.pathname = url.pathname.replace(/\/$/, "") || "/";
|
|
return url;
|
|
}
|
|
|
|
function safeCoreError(value) {
|
|
return typeof value === "string" && /^device_[a-z0-9._:-]{2,120}$/.test(value)
|
|
? value
|
|
: "device_core_unavailable";
|
|
}
|
|
|
|
function serviceError(code, statusCode) {
|
|
const error = new Error(code);
|
|
error.statusCode = statusCode;
|
|
return error;
|
|
}
|