NODEDC_DEVICE_CORE/services/device-control-core/test/sensitive-reference-management.test.mjs

import assert from "node:assert/strict";
import test from "node:test";

import {
  DEVICE_SENSITIVE_REFERENCE_COMMAND_KINDS,
  normalizeSensitiveReferenceManagementCommand,
} from "../src/sensitive-reference-management.mjs";
import {
  ALL_DEVICE_MANAGEMENT_COMMAND_KINDS,
  normalizeDeviceManagementCommand,
} from "../src/management-command.mjs";
import {
  normalizeNdcCredentialReference as normalizeRuntimeCredentialReference,
} from "../src/credential-reference.mjs";
import {
  normalizeNdcCredentialReference as normalizePlatformCredentialReference,
} from "../../../../platform/packages/external-provider-contract/src/credential-reference.mjs";

const projectRef = "project:11111111-1111-4111-8111-111111111111";
const deviceRef = "device:22222222-2222-4222-8222-222222222222";

test("credential binding commands share the strict management surface", () => {
  for (const kind of DEVICE_SENSITIVE_REFERENCE_COMMAND_KINDS) {
    assert.equal(ALL_DEVICE_MANAGEMENT_COMMAND_KINDS.includes(kind), true);
  }
  assert.equal(
    normalizeDeviceManagementCommand(
      "device_credential_binding.upsert",
      upsertInput(),
    ).projectId,
    projectRef.slice("project:".length),
  );
});

test("credential binding accepts only the platform canonical opaque ref", () => {
  const command = normalizeSensitiveReferenceManagementCommand(
    "device_credential_binding.upsert",
    upsertInput(),
  );

  assert.deepEqual(command.credentialRef, {
    owner: "ndc_l2_credentials",
    reference: "ndc-credref:pilot-command-0001",
  });
  assert.equal(Object.isFrozen(command.credentialRef), true);
  assert.throws(
    () => normalizeSensitiveReferenceManagementCommand(
      "device_credential_binding.upsert",
      {
        ...upsertInput(),
        credentialRef: {
          owner: "device_core",
          reference: "ndc-credref:pilot-command-0001",
        },
      },
    ),
    /ndc_credential_reference_owner_invalid/,
  );
  assert.throws(
    () => normalizeSensitiveReferenceManagementCommand(
      "device_credential_binding.upsert",
      {
        ...upsertInput(),
        credentialRef: {
          owner: "ndc_l2_credentials",
          reference: "Bearer plaintext-is-forbidden",
        },
      },
    ),
    /ndc_credential_reference_value_invalid/,
  );
});

test("runtime credential reference adapter matches the platform contract", () => {
  const accepted = [
    {
      owner: "ndc_l2_credentials",
      reference: "ndc-credref:pilot-command-0001",
    },
    {
      owner: "ndc_l2_credentials",
      reference: "ndc-credref:A1234567",
    },
  ];
  for (const input of accepted) {
    assert.deepEqual(
      normalizeRuntimeCredentialReference(input),
      normalizePlatformCredentialReference(input),
    );
  }

  const rejected = [
    null,
    [],
    { owner: "device_core", reference: "ndc-credref:pilot-command-0001" },
    { owner: "ndc_l2_credentials", reference: "secret:test" },
    {
      owner: "ndc_l2_credentials",
      reference: "ndc-credref:pilot-command-0001",
      token: "forbidden",
    },
  ];
  for (const input of rejected) {
    let runtimeError;
    let platformError;
    try {
      normalizeRuntimeCredentialReference(input);
    } catch (error) {
      runtimeError = error;
    }
    try {
      normalizePlatformCredentialReference(input);
    } catch (error) {
      platformError = error;
    }
    assert.equal(runtimeError?.message, platformError?.message);
  }
});

test("credential binding rejects raw secret-shaped fields", () => {
  for (const field of ["password", "token", "secretValue", "endpoint"]) {
    assert.throws(
      () => normalizeSensitiveReferenceManagementCommand(
        "device_credential_binding.upsert",
        { ...upsertInput(), [field]: "forbidden" },
      ),
      new RegExp(`device_management_command_field_unexpected:${field}`),
    );
  }
});

test("credential revoke has no credential reference input", () => {
  const command = normalizeSensitiveReferenceManagementCommand(
    "device_credential_binding.revoke",
    {
      projectRef,
      deviceRef,
      purpose: "tracker.command",
      resolutionCode: "operator.rotation",
    },
  );

  assert.equal(command.resolutionCode, "operator.rotation");
  assert.equal("credentialRef" in command, false);
});

function upsertInput() {
  return {
    projectRef,
    deviceRef,
    purpose: "tracker.command",
    credentialRef: {
      owner: "ndc_l2_credentials",
      reference: "ndc-credref:pilot-command-0001",
    },
  };
}