feat(device-plane): enable B2 discovery ingress

2026-07-26 00:52:31 +03:00
parent 3c538ad98c
commit 2b1795509b
19 changed files with 2375 additions and 156 deletions
@@ -0,0 +1,60 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { createCoreDiscoveryClient } from "../src/core-client.mjs";
+
+const gatewayToken = "test-only-gateway-token-with-32-bytes";
+
+test("posts a discovery through the authenticated internal Core boundary", async () => {
+  let captured;
+  const observe = createCoreDiscoveryClient({
+    coreUrl: "http://device-control-core:18120",
+    gatewayToken,
+    fetchImpl: async (url, options) => {
+      captured = { url, options };
+      return new Response(JSON.stringify({
+        ok: true,
+        discovery: {
+          lifecycleState: "quarantine",
+          commandTransport: "disabled",
+        },
+      }), {
+        status: 201,
+        headers: { "Content-Type": "application/json" },
+      });
+    },
+  });
+  const signal = {
+    schemaVersion: "nodedc.device.discovery-signal.v1",
+    sessionRef: "session:test",
+  };
+  const discovery = await observe(signal);
+  assert.equal(
+    captured.url,
+    "http://device-control-core:18120/internal/v1/device-discoveries:observe",
+  );
+  assert.equal(
+    captured.options.headers.Authorization,
+    `Bearer ${gatewayToken}`,
+  );
+  assert.deepEqual(JSON.parse(captured.options.body), signal);
+  assert.equal(discovery.lifecycleState, "quarantine");
+});
+
+test("fails closed when Core does not return a quarantine view", async () => {
+  const observe = createCoreDiscoveryClient({
+    coreUrl: "http://device-control-core:18120",
+    gatewayToken,
+    fetchImpl: async () => new Response(JSON.stringify({
+      ok: true,
+      discovery: {
+        lifecycleState: "claimed",
+        commandTransport: "disabled",
+      },
+    }), { status: 200 }),
+  });
+  await assert.rejects(
+    () => observe({ schemaVersion: "test" }),
+    /device_gateway_core_ingest_contract_invalid/,
+  );
+});
@@ -0,0 +1,112 @@
+import assert from "node:assert/strict";
+import { connect } from "node:net";
+import test from "node:test";
+
+import {
+  createControlCoreApp,
+} from "../../device-control-core/src/app.mjs";
+import { createCoreDiscoveryClient } from "../src/core-client.mjs";
+import { createDeviceGatewayRuntime } from "../src/runtime.mjs";
+
+const gatewayToken = "test-only-gateway-token-with-32-bytes";
+const identifierPepper = "test-only-identifier-pepper-with-32-bytes";
+const specificationHeader = Buffer.from(
+  "FF23E9EF782DE7120300",
+  "hex",
+);
+const specificationPackage = Buffer.from(
+  "5B01010000FBDEC251EC5D",
+  "hex",
+);
+
+test("B2 HEADER2 becomes a persisted masked quarantine discovery before ACK", async () => {
+  let stored;
+  const core = createControlCoreApp({
+    discoveryIngestEnabled: true,
+    gatewayToken,
+    identifierPepper,
+    repository: {
+      health: async () => "ready",
+      upsertQuarantineDiscovery: async (value) => {
+        stored = value;
+        return {
+          created: true,
+          value: {
+            ...value.safeView,
+            discoveryRef: "discovery:integration-001",
+          },
+        };
+      },
+    },
+  });
+  await listen(core);
+  const coreAddress = core.address();
+  const observe = createCoreDiscoveryClient({
+    coreUrl: `http://127.0.0.1:${coreAddress.port}`,
+    gatewayToken,
+  });
+  const gateway = createDeviceGatewayRuntime({
+    healthPort: 0,
+    tcpHost: "0.0.0.0",
+    tcpPort: 0,
+    listenEnabled: true,
+    publicIngressEnabled: true,
+    now: () => new Date(0x52db95de * 1000),
+    onDiscovery: observe,
+  });
+  const addresses = await gateway.start();
+  try {
+    const response = await exchange(
+      addresses.tcpAddress.port,
+      Buffer.concat([specificationHeader, specificationPackage]),
+      13,
+    );
+    assert.equal(
+      response.toString("hex").toUpperCase(),
+      "7B0400A0DE95DB527D7B00017D",
+    );
+    assert.match(stored.identifierDigest, /^hmac-sha256:[a-f0-9]{64}$/);
+    assert.equal(stored.safeView.lifecycleState, "quarantine");
+    assert.equal(stored.safeView.identifier.masked, "***********7769");
+    assert.equal(stored.safeView.commandTransport, "disabled");
+    assert.equal(
+      JSON.stringify(stored).includes("865209039777769"),
+      false,
+    );
+  } finally {
+    await gateway.stop();
+    await close(core);
+  }
+});
+
+function listen(server) {
+  return new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", resolve);
+  });
+}
+
+function close(server) {
+  return new Promise((resolve, reject) => {
+    server.close((error) => (error ? reject(error) : resolve()));
+  });
+}
+
+function exchange(port, payload, expectedBytes) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    let byteLength = 0;
+    const socket = connect({ host: "127.0.0.1", port }, () => {
+      socket.write(payload);
+    });
+    socket.on("data", (chunk) => {
+      chunks.push(chunk);
+      byteLength += chunk.length;
+      if (byteLength >= expectedBytes) {
+        socket.destroy();
+        resolve(Buffer.concat(chunks, byteLength));
+      }
+    });
+    socket.on("error", reject);
+  });
+}
@@ -4,6 +4,15 @@ import test from "node:test";

 import { createDeviceGatewayRuntime } from "../src/runtime.mjs";

+const specificationHeader = Buffer.from(
+  "FF23E9EF782DE7120300",
+  "hex",
+);
+const specificationPackage = Buffer.from(
+  "5B01010000FBDEC251EC5D",
+  "hex",
+);
+
 test("baseline health exposes no public ingress and no command transport", async () => {
  const runtime = createDeviceGatewayRuntime({
    healthPort: 0,
@@ -25,37 +34,93 @@ test("baseline health exposes no public ingress and no command transport", async
  }
 });

-test("loopback evidence listener emits no acknowledgement or command bytes", async () => {
+test("discovery-only ingress persists HEADER2 before acknowledging packages", async () => {
+  const captured = [];
+  const runtime = createDeviceGatewayRuntime({
+    healthPort: 0,
+    tcpHost: "0.0.0.0",
+    tcpPort: 0,
+    listenEnabled: true,
+    publicIngressEnabled: true,
+    now: () => new Date(0x52db95de * 1000),
+    onDiscovery: async (value) => captured.push(value),
+  });
+  const addresses = await runtime.start();
+  const client = await connectAndCollect(addresses.tcpAddress.port);
+  try {
+    client.socket.write(specificationHeader.subarray(0, 4));
+    await new Promise((resolve) => setImmediate(resolve));
+    assert.equal(client.bytes().length, 0);
+
+    client.socket.write(specificationHeader.subarray(4));
+    await client.waitForBytes(9);
+    assert.equal(
+      client.bytes().subarray(0, 9).toString("hex").toUpperCase(),
+      "7B0400A0DE95DB527D",
+    );
+    assert.equal(captured.length, 1);
+    assert.equal(captured[0].identifier.value, "865209039777769");
+    assert.equal(captured[0].evidence.framingStatus, "verified");
+    assert.equal(captured[0].commandTransport, undefined);
+
+    client.socket.write(specificationPackage);
+    await client.waitForBytes(13);
+    assert.equal(
+      client.bytes().subarray(9).toString("hex").toUpperCase(),
+      "7B00017D",
+    );
+    assert.equal(runtime.status().totalDiscoveries, 1);
+    assert.equal(runtime.status().totalPackagesAcknowledged, 1);
+    assert.equal(runtime.status().commandTransport, "disabled");
+    assert.equal(runtime.status().publicIngress, "discovery-only");
+
+    const response = await fetch(
+      `http://127.0.0.1:${addresses.healthAddress.port}/healthz`,
+    );
+    const body = await response.json();
+    assert.equal(body.framing, "verified-read-only");
+    assert.equal(body.tcpListener, "discovery-only");
+    assert.equal(body.publicIngress, "discovery-only");
+    assert.equal(body.commandTransport, "disabled");
+  } finally {
+    client.socket.destroy();
+    await runtime.stop();
+  }
+});
+
+test("does not acknowledge malformed or unverified initial bytes", async () => {
  const captured = [];
  const runtime = createDeviceGatewayRuntime({
    healthPort: 0,
    tcpPort: 0,
    listenEnabled: true,
-    onEvidence: (value) => captured.push(value),
+    onDiscovery: async (value) => captured.push(value),
  });
  const addresses = await runtime.start();
  try {
    const received = await sendAndCollect(
      addresses.tcpAddress.port,
-      Buffer.from(
-        "unverified-frame-with-fake-identifier-000000000000001",
-        "utf8",
-      ),
+      Buffer.from("not-a-b2-header", "utf8"),
    );
    assert.equal(received.length, 0);
-    assert.equal(captured.length, 1);
-    assert.equal(captured[0].evidence.identifierExtracted, false);
-    assert.equal(
-      JSON.stringify(captured).includes("000000000000001"),
-      false,
-    );
-    assert.equal(runtime.status().totalEvidence, 1);
-    assert.equal(runtime.status().commandTransport, "disabled");
+    assert.equal(captured.length, 0);
+    assert.equal(runtime.status().totalRejected, 1);
  } finally {
    await runtime.stop();
  }
 });

+test("public ingress requires an authenticated discovery sink", () => {
+  assert.throws(
+    () => createDeviceGatewayRuntime({
+      listenEnabled: true,
+      publicIngressEnabled: true,
+      tcpHost: "0.0.0.0",
+    }),
+    /device_gateway_discovery_sink_required/,
+  );
+});
+
 test("baseline rejects non-loopback binding", () => {
  assert.throws(
    () => createDeviceGatewayRuntime({
@@ -66,7 +131,7 @@ test("baseline rejects non-loopback binding", () => {
  );
 });

-test("container health may bind all interfaces while TCP stays loopback-only", async () => {
+test("container health may bind all interfaces while TCP stays disabled", async () => {
  const runtime = createDeviceGatewayRuntime({
    healthHost: "0.0.0.0",
    healthPort: 0,
@@ -82,6 +147,40 @@ test("container health may bind all interfaces while TCP stays loopback-only", a
  }
 });

+function connectAndCollect(port) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    let byteLength = 0;
+    const waiters = [];
+    const socket = connect({ host: "127.0.0.1", port }, () => {
+      resolve({
+        socket,
+        bytes: () => Buffer.concat(chunks, byteLength),
+        waitForBytes: (minimum) => {
+          if (byteLength >= minimum) return Promise.resolve();
+          return new Promise((waitResolve, waitReject) => {
+            waiters.push({ minimum, waitResolve, waitReject });
+          });
+        },
+      });
+    });
+    socket.on("data", (chunk) => {
+      chunks.push(chunk);
+      byteLength += chunk.length;
+      for (let index = waiters.length - 1; index >= 0; index -= 1) {
+        if (byteLength >= waiters[index].minimum) {
+          waiters[index].waitResolve();
+          waiters.splice(index, 1);
+        }
+      }
+    });
+    socket.on("error", (error) => {
+      for (const waiter of waiters.splice(0)) waiter.waitReject(error);
+      reject(error);
+    });
+  });
+}
+
 function sendAndCollect(port, payload) {
  return new Promise((resolve, reject) => {
    const chunks = [];
@@ -89,7 +188,7 @@ function sendAndCollect(port, payload) {
      socket.end(payload);
    });
    socket.on("data", (chunk) => chunks.push(chunk));
-    socket.on("end", () => resolve(Buffer.concat(chunks)));
+    socket.on("close", () => resolve(Buffer.concat(chunks)));
    socket.on("error", reject);
  });
 }