feat(device-core): add restricted identity references

2026-08-10 18:31:30 +03:00
parent fceaca9546
commit 422ddb020f
20 changed files with 1413 additions and 7 deletions
@@ -0,0 +1,105 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import {
+  DEVICE_SENSITIVE_REFERENCE_COMMAND_KINDS,
+  normalizeSensitiveReferenceManagementCommand,
+} from "../src/sensitive-reference-management.mjs";
+import {
+  ALL_DEVICE_MANAGEMENT_COMMAND_KINDS,
+  normalizeDeviceManagementCommand,
+} from "../src/management-command.mjs";
+
+const projectRef = "project:11111111-1111-4111-8111-111111111111";
+const deviceRef = "device:22222222-2222-4222-8222-222222222222";
+
+test("credential binding commands share the strict management surface", () => {
+  for (const kind of DEVICE_SENSITIVE_REFERENCE_COMMAND_KINDS) {
+    assert.equal(ALL_DEVICE_MANAGEMENT_COMMAND_KINDS.includes(kind), true);
+  }
+  assert.equal(
+    normalizeDeviceManagementCommand(
+      "device_credential_binding.upsert",
+      upsertInput(),
+    ).projectId,
+    projectRef.slice("project:".length),
+  );
+});
+
+test("credential binding accepts only the platform canonical opaque ref", () => {
+  const command = normalizeSensitiveReferenceManagementCommand(
+    "device_credential_binding.upsert",
+    upsertInput(),
+  );
+
+  assert.deepEqual(command.credentialRef, {
+    owner: "ndc_l2_credentials",
+    reference: "ndc-credref:pilot-command-0001",
+  });
+  assert.equal(Object.isFrozen(command.credentialRef), true);
+  assert.throws(
+    () => normalizeSensitiveReferenceManagementCommand(
+      "device_credential_binding.upsert",
+      {
+        ...upsertInput(),
+        credentialRef: {
+          owner: "device_core",
+          reference: "ndc-credref:pilot-command-0001",
+        },
+      },
+    ),
+    /ndc_credential_reference_owner_invalid/,
+  );
+  assert.throws(
+    () => normalizeSensitiveReferenceManagementCommand(
+      "device_credential_binding.upsert",
+      {
+        ...upsertInput(),
+        credentialRef: {
+          owner: "ndc_l2_credentials",
+          reference: "Bearer plaintext-is-forbidden",
+        },
+      },
+    ),
+    /ndc_credential_reference_value_invalid/,
+  );
+});
+
+test("credential binding rejects raw secret-shaped fields", () => {
+  for (const field of ["password", "token", "secretValue", "endpoint"]) {
+    assert.throws(
+      () => normalizeSensitiveReferenceManagementCommand(
+        "device_credential_binding.upsert",
+        { ...upsertInput(), [field]: "forbidden" },
+      ),
+      new RegExp(`device_management_command_field_unexpected:${field}`),
+    );
+  }
+});
+
+test("credential revoke has no credential reference input", () => {
+  const command = normalizeSensitiveReferenceManagementCommand(
+    "device_credential_binding.revoke",
+    {
+      projectRef,
+      deviceRef,
+      purpose: "tracker.command",
+      resolutionCode: "operator.rotation",
+    },
+  );
+
+  assert.equal(command.resolutionCode, "operator.rotation");
+  assert.equal("credentialRef" in command, false);
+});
+
+function upsertInput() {
+  return {
+    projectRef,
+    deviceRef,
+    purpose: "tracker.command",
+    credentialRef: {
+      owner: "ndc_l2_credentials",
+      reference: "ndc-credref:pilot-command-0001",
+    },
+  };
+}