feat(device-core): add restricted identity references

This commit is contained in:
Codex
2026-08-10 18:31:30 +03:00
parent fceaca9546
commit 422ddb020f
20 changed files with 1413 additions and 7 deletions
@@ -1,6 +1,12 @@
import { EXTERNAL_PROVIDER_CONTRACT_VERSION } from "./contract-version.mjs";
import { isNdcCredentialReferenceValue } from "./credential-reference.mjs";
export { EXTERNAL_PROVIDER_CONTRACT_VERSION } from "./contract-version.mjs";
export {
NDC_CREDENTIAL_REFERENCE_OWNER,
isNdcCredentialReferenceValue,
normalizeNdcCredentialReference,
} from "./credential-reference.mjs";
export { validateIntakeBatch } from "./intake-batch.mjs";
export {
DATA_PRODUCT_GEOMETRY_TYPES,
@@ -199,6 +205,12 @@ export function validateConnectionProfile(value) {
if (value?.credentialRef?.owner && value.credentialRef.owner !== "ndc_l2_credentials") {
errors.push("credentialRef.owner_must_be_ndc_l2_credentials");
}
if (
typeof value?.credentialRef?.reference === "string"
&& !isNdcCredentialReferenceValue(value.credentialRef.reference)
) {
errors.push("credentialRef.reference_must_be_canonical_ndc_ref");
}
if (containsSecretLikeMaterial(value)) errors.push("profile_must_not_contain_secret_material");
if (value?.scope !== undefined) {
if (!isPlainObject(value.scope)) {