70 lines
3.6 KiB
Markdown
70 lines
3.6 KiB
Markdown
# NODE.DC Device Manager
|
|
|
|
Standalone Device Core application shell for Hub-authenticated device administration.
|
|
It is intentionally vendor-neutral: adapters and model profiles describe protocol-specific
|
|
behavior; projects, inventory, collections and access remain shared Device Core concepts.
|
|
|
|
## Runtime boundary
|
|
|
|
- The browser talks only to the Device Manager BFF under `/api/device-manager/*`.
|
|
- Launcher consumes the one-time handoff and periodically revalidates the process-local,
|
|
opaque Device Manager cookie.
|
|
- The BFF derives the Core actor from that trusted Hub identity. Browser-supplied role,
|
|
group or owner headers are ignored.
|
|
- The BFF reads the Core bearer token from `NODEDC_DEVICE_CORE_TOKEN_FILE`; the token is
|
|
never embedded into client assets or accepted as a raw environment value.
|
|
- Device Control Core owns authorization, lifecycle validation, idempotency and persistence.
|
|
- Query responses contain masked identifiers and bounded metadata only. Identifier and
|
|
credential digests, external approval proofs, command parameters/transport refs, raw
|
|
configuration documents and audit payloads stay inside Device Control Core.
|
|
|
|
The project workspace covers inventory, discovery, collections, adapter/profile metadata,
|
|
Edges, routes, sessions, bindings, configuration state, the honest command ledger, immutable
|
|
audit metadata and project grants. It also joins the official ontology projection for stable
|
|
Assets, temporal Device-to-Asset bindings, provider-neutral Hosts, endpoints, deployments,
|
|
service instances and freshness-bounded health observations. Navigation and actions are
|
|
derived from effective project capabilities. Global adapter/profile/Edge mutation is
|
|
additionally restricted to a Hub owner.
|
|
|
|
Host credentials are accepted only as opaque `secret-ref:*` values by the server-side Core
|
|
command. The browser projection receives only `managementCredentialConfigured`; it never
|
|
receives the reference or secret. Missing or expired health evidence is rendered as
|
|
`unobserved`, never inferred as `unreachable`. Arbitrary WebSSH remains disabled pending a
|
|
separate short-lived management-session and break-glass design.
|
|
|
|
Command planning and transport intentionally have no Device Manager mutation route yet.
|
|
The UI never presents `sent` as success: `acknowledged` and `verified` remain different
|
|
ledger states, and the disabled transport policy is visible in the Commands section.
|
|
|
|
Hub currently supplies identity and groups but no signed company-membership/owner-scope
|
|
claim. Therefore an admin may create projects in their personal scope. Existing company
|
|
projects remain visible through explicit project grants, but company project creation stays
|
|
closed until Hub extends the handoff contract.
|
|
|
|
## Local source preview
|
|
|
|
The preview store starts empty and exists only to exercise the shell without a deployed Core.
|
|
All visible resources must still be created through the same command-shaped BFF endpoints.
|
|
It is forbidden when `NODE_ENV=production`.
|
|
|
|
```sh
|
|
NODEDC_DEVICE_MANAGER_LOCAL_PREVIEW=1 \
|
|
NODEDC_DEVICE_MANAGER_AUTH_REQUIRED=0 \
|
|
npm run build --workspace @nodedc/device-manager
|
|
|
|
NODEDC_DEVICE_MANAGER_LOCAL_PREVIEW=1 \
|
|
NODEDC_DEVICE_MANAGER_AUTH_REQUIRED=0 \
|
|
npm run serve --workspace @nodedc/device-manager
|
|
```
|
|
|
|
Production additionally requires:
|
|
|
|
- `NODEDC_LAUNCHER_BASE_URL`
|
|
- `NODEDC_LAUNCHER_INTERNAL_URL`
|
|
- `NODEDC_INTERNAL_ACCESS_TOKEN` or `NODEDC_PLATFORM_SERVICE_TOKEN`
|
|
- `NODEDC_DEVICE_CORE_INTERNAL_URL`
|
|
- `NODEDC_DEVICE_CORE_TOKEN_FILE`
|
|
|
|
The application source does not create a Hub service entry, DNS record, reverse proxy,
|
|
database or deployment artifact. Those remain explicit infrastructure phases.
|