NODEDC_DESIGN_GUIDELINE/apps/device-manager/README.md

NODE.DC Device Manager

Standalone Device Core application shell for Hub-authenticated device administration. It is intentionally vendor-neutral: adapters and model profiles describe protocol-specific behavior; projects, inventory, collections and access remain shared Device Core concepts.

Runtime boundary

• The browser talks only to the Device Manager BFF under /api/device-manager/*.
• Launcher consumes the one-time handoff and periodically revalidates the process-local, opaque Device Manager cookie.
• The BFF derives the Core actor from that trusted Hub identity. Browser-supplied role, group or owner headers are ignored.
• The BFF reads the Core bearer token from NODEDC_DEVICE_CORE_TOKEN_FILE; the token is never embedded into client assets or accepted as a raw environment value.
• Device Control Core owns authorization, lifecycle validation, idempotency and persistence.
• Query responses contain masked identifiers only. Digests and credential references stay inside Device Control Core.

Hub currently supplies identity and groups but no signed company-membership/owner-scope claim. Therefore an admin may create projects in their personal scope. Existing company projects remain visible through explicit project grants, but company project creation stays closed until Hub extends the handoff contract.

Local source preview

The preview store starts empty and exists only to exercise the shell without a deployed Core. All visible resources must still be created through the same command-shaped BFF endpoints. It is forbidden when NODE_ENV=production.

NODEDC_DEVICE_MANAGER_LOCAL_PREVIEW=1 \
NODEDC_DEVICE_MANAGER_AUTH_REQUIRED=0 \
npm run build --workspace @nodedc/device-manager

NODEDC_DEVICE_MANAGER_LOCAL_PREVIEW=1 \
NODEDC_DEVICE_MANAGER_AUTH_REQUIRED=0 \
npm run serve --workspace @nodedc/device-manager

Production additionally requires:

• NODEDC_LAUNCHER_BASE_URL
• NODEDC_LAUNCHER_INTERNAL_URL
• NODEDC_INTERNAL_ACCESS_TOKEN or NODEDC_PLATFORM_SERVICE_TOKEN
• NODEDC_DEVICE_CORE_INTERNAL_URL
• NODEDC_DEVICE_CORE_TOKEN_FILE

The application source does not create a Hub service entry, DNS record, reverse proxy, database or deployment artifact. Those remain explicit infrastructure phases.