feat(platform): add managed data product history plane

services/external-data-plane/test/api.integration.test.mjs

@@ -5,7 +5,7 @@ import { mkdtemp, rm, writeFile } from "node:fs/promises";
 import net from "node:net";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { validateDataProductPatch, validateDataProductSnapshot } from "@nodedc/external-provider-contract/data-plane";
+import { validateDataProductHistory, validateDataProductPatch, validateDataProductSnapshot } from "@nodedc/external-provider-contract/data-plane";
 import {
   MANAGED_PROVISIONER_HEADERS,
   managedProvisionerSigningPayload,
@@ -77,7 +77,7 @@ try {
   const managedBody = {
     source: scope,
     allowedDataProductIds: [productId],
-    expiresAt: expiry,
+    expiresAt: null,
     generation: 1,
     capabilityDigest: createHash("sha256").update(managedToken, "utf8").digest("hex"),
   };
@@ -194,6 +194,48 @@ try {
   });
   assert.equal(rejectedManagedGeneration1.status, 401);
 
+  const managedReaderToken = "ndc_edprb_managed_api_test_0123456789abcdefghijklmnopqrstuvwxyz";
+  const managedReaderBody = {
+    source: scope,
+    allowedDataProductIds: [productId],
+    expiresAt: null,
+    generation: 1,
+    capabilityDigest: createHash("sha256").update(managedReaderToken, "utf8").digest("hex"),
+  };
+  const managedReaderPath = "/internal/data-plane/v1/reader-bindings/by-key/engine.api-connection.positions-reader";
+  const managedReaderResults = await Promise.all([
+    rawJsonRequest(managedReaderPath, { method: "PUT", managedSignature: true, body: managedReaderBody }),
+    rawJsonRequest(managedReaderPath, { method: "PUT", managedSignature: true, body: managedReaderBody }),
+  ]);
+  assert.deepEqual(managedReaderResults.map(({ value }) => value.idempotent).sort(), [false, true]);
+  assert.equal(managedReaderResults[0].value.readerBinding.id, managedReaderResults[1].value.readerBinding.id);
+  assert.equal("token" in managedReaderResults[0].value, false);
+  assert.equal(JSON.stringify(managedReaderResults[0].value).includes(managedReaderBody.capabilityDigest), false);
+  assert.deepEqual(
+    (await jsonRequest("/internal/data-plane/v1/reader/data-products", { token: managedReaderToken })).dataProducts.map((value) => value.id),
+    [productId],
+  );
+  const legacyManagedReaderRevoke = await fetch(
+    `${baseUrl}/internal/data-plane/v1/reader-bindings/${managedReaderResults[0].value.readerBinding.id}/revoke`,
+    { method: "POST", headers: { Authorization: `Bearer ${provisionerSecret}` } },
+  );
+  assert.equal(legacyManagedReaderRevoke.status, 404);
+  const managedReaderRevoke = await jsonRequest(
+    `${managedReaderPath}/generations/1/revoke`,
+    { method: "POST", managedSignature: true },
+  );
+  assert.equal(managedReaderRevoke.idempotent, false);
+  assert.equal(managedReaderRevoke.readerBinding.active, false);
+  const managedReaderRevokeRetry = await jsonRequest(
+    `${managedReaderPath}/generations/1/revoke`,
+    { method: "POST", managedSignature: true },
+  );
+  assert.equal(managedReaderRevokeRetry.idempotent, true);
+  const rejectedManagedReader = await fetch(`${baseUrl}/internal/data-plane/v1/reader/data-products`, {
+    headers: { Authorization: `Bearer ${managedReaderToken}` },
+  });
+  assert.equal(rejectedManagedReader.status, 401);
+
   const manualWriterBody = { source: scope, allowedDataProductIds: [productId], expiresAt: expiry };
   const signedOnlyManualProvisioning = await signedFetch("/internal/data-plane/v1/writer-bindings", {
     method: "POST",
@@ -245,6 +287,13 @@ try {
   const snapshot = await jsonRequest(`/internal/data-plane/v1/data-products/${productId}/snapshot`, { token: reader.token });
   assert.equal(validateDataProductSnapshot(snapshot).ok, true);
   assert.equal(snapshot.facts.length, 1);
+  const history = await jsonRequest(
+    `/internal/data-plane/v1/data-products/${productId}/history?from=2026-07-15T12%3A00%3A00.000Z&to=2026-07-15T12%3A02%3A00.000Z&resolutionMs=60000&sourceIds=unit-01&limit=100`,
+    { token: reader.token },
+  );
+  assert.equal(validateDataProductHistory(history).ok, true);
+  assert.equal(history.facts.length, 1);
+  assert.equal(history.facts[0].bucketStart, "2026-07-15T12:00:00.000Z");
 
   const controller = new AbortController();
   const response = await fetch(`${baseUrl}/internal/data-plane/v1/data-products/${productId}/stream?after=${snapshot.cursor}`, {