feat: establish standalone Device Core repository

2026-08-21 11:51:21 +03:00
commit e0bac205d0
244 changed files with 51962 additions and 0 deletions
@@ -0,0 +1,157 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import {
+  DEVICE_SENSITIVE_REFERENCE_COMMAND_KINDS,
+  normalizeSensitiveReferenceManagementCommand,
+} from "../src/sensitive-reference-management.mjs";
+import {
+  ALL_DEVICE_MANAGEMENT_COMMAND_KINDS,
+  normalizeDeviceManagementCommand,
+} from "../src/management-command.mjs";
+import {
+  normalizeNdcCredentialReference as normalizeRuntimeCredentialReference,
+} from "../src/credential-reference.mjs";
+import {
+  normalizeNdcCredentialReference as normalizePlatformCredentialReference,
+} from "../../../../platform/packages/external-provider-contract/src/credential-reference.mjs";
+
+const projectRef = "project:11111111-1111-4111-8111-111111111111";
+const deviceRef = "device:22222222-2222-4222-8222-222222222222";
+
+test("credential binding commands share the strict management surface", () => {
+  for (const kind of DEVICE_SENSITIVE_REFERENCE_COMMAND_KINDS) {
+    assert.equal(ALL_DEVICE_MANAGEMENT_COMMAND_KINDS.includes(kind), true);
+  }
+  assert.equal(
+    normalizeDeviceManagementCommand(
+      "device_credential_binding.upsert",
+      upsertInput(),
+    ).projectId,
+    projectRef.slice("project:".length),
+  );
+});
+
+test("credential binding accepts only the platform canonical opaque ref", () => {
+  const command = normalizeSensitiveReferenceManagementCommand(
+    "device_credential_binding.upsert",
+    upsertInput(),
+  );
+
+  assert.deepEqual(command.credentialRef, {
+    owner: "ndc_l2_credentials",
+    reference: "ndc-credref:pilot-command-0001",
+  });
+  assert.equal(Object.isFrozen(command.credentialRef), true);
+  assert.throws(
+    () => normalizeSensitiveReferenceManagementCommand(
+      "device_credential_binding.upsert",
+      {
+        ...upsertInput(),
+        credentialRef: {
+          owner: "device_core",
+          reference: "ndc-credref:pilot-command-0001",
+        },
+      },
+    ),
+    /ndc_credential_reference_owner_invalid/,
+  );
+  assert.throws(
+    () => normalizeSensitiveReferenceManagementCommand(
+      "device_credential_binding.upsert",
+      {
+        ...upsertInput(),
+        credentialRef: {
+          owner: "ndc_l2_credentials",
+          reference: "Bearer plaintext-is-forbidden",
+        },
+      },
+    ),
+    /ndc_credential_reference_value_invalid/,
+  );
+});
+
+test("runtime credential reference adapter matches the platform contract", () => {
+  const accepted = [
+    {
+      owner: "ndc_l2_credentials",
+      reference: "ndc-credref:pilot-command-0001",
+    },
+    {
+      owner: "ndc_l2_credentials",
+      reference: "ndc-credref:A1234567",
+    },
+  ];
+  for (const input of accepted) {
+    assert.deepEqual(
+      normalizeRuntimeCredentialReference(input),
+      normalizePlatformCredentialReference(input),
+    );
+  }
+
+  const rejected = [
+    null,
+    [],
+    { owner: "device_core", reference: "ndc-credref:pilot-command-0001" },
+    { owner: "ndc_l2_credentials", reference: "secret:test" },
+    {
+      owner: "ndc_l2_credentials",
+      reference: "ndc-credref:pilot-command-0001",
+      token: "forbidden",
+    },
+  ];
+  for (const input of rejected) {
+    let runtimeError;
+    let platformError;
+    try {
+      normalizeRuntimeCredentialReference(input);
+    } catch (error) {
+      runtimeError = error;
+    }
+    try {
+      normalizePlatformCredentialReference(input);
+    } catch (error) {
+      platformError = error;
+    }
+    assert.equal(runtimeError?.message, platformError?.message);
+  }
+});
+
+test("credential binding rejects raw secret-shaped fields", () => {
+  for (const field of ["password", "token", "secretValue", "endpoint"]) {
+    assert.throws(
+      () => normalizeSensitiveReferenceManagementCommand(
+        "device_credential_binding.upsert",
+        { ...upsertInput(), [field]: "forbidden" },
+      ),
+      new RegExp(`device_management_command_field_unexpected:${field}`),
+    );
+  }
+});
+
+test("credential revoke has no credential reference input", () => {
+  const command = normalizeSensitiveReferenceManagementCommand(
+    "device_credential_binding.revoke",
+    {
+      projectRef,
+      deviceRef,
+      purpose: "tracker.command",
+      resolutionCode: "operator.rotation",
+    },
+  );
+
+  assert.equal(command.resolutionCode, "operator.rotation");
+  assert.equal("credentialRef" in command, false);
+});
+
+function upsertInput() {
+  return {
+    projectRef,
+    deviceRef,
+    purpose: "tracker.command",
+    credentialRef: {
+      owner: "ndc_l2_credentials",
+      reference: "ndc-credref:pilot-command-0001",
+    },
+  };
+}