feat(device-core): add restricted identity references

2026-08-10 18:31:30 +03:00
parent fceaca9546
commit 422ddb020f
20 changed files with 1413 additions and 7 deletions
@@ -2,7 +2,10 @@ import assert from "node:assert/strict";
 import {
  EXTERNAL_PROVIDER_CONTRACT_VERSION,
  FOUNDRY_BINDING_UPSERT_SCHEMA_VERSION,
+  NDC_CREDENTIAL_REFERENCE_OWNER,
  assertValid,
+  isNdcCredentialReferenceValue,
+  normalizeNdcCredentialReference,
  validateCollectionProfile,
  validateConnectionProfile,
  validateDataProduct,
@@ -19,6 +22,29 @@ assert.equal(validateConnectionProfile({
  ...geliosPositionsCurrentExample.connection,
  credentialRef: { ...geliosPositionsCurrentExample.connection.credentialRef, owner: "engine" },
 }).errors.includes("credentialRef.owner_must_be_ndc_l2_credentials"), true);
+assert.deepEqual(normalizeNdcCredentialReference({
+  owner: NDC_CREDENTIAL_REFERENCE_OWNER,
+  reference: "ndc-credref:provider-example-0001",
+}), {
+  owner: "ndc_l2_credentials",
+  reference: "ndc-credref:provider-example-0001",
+});
+assert.equal(isNdcCredentialReferenceValue("ndc-credref:provider-example-0001"), true);
+assert.equal(isNdcCredentialReferenceValue("secret://provider-example"), false);
+assert.equal(validateConnectionProfile({
+  ...geliosPositionsCurrentExample.connection,
+  credentialRef: {
+    owner: "ndc_l2_credentials",
+    reference: "provider-example-0001",
+  },
+}).errors.includes("credentialRef.reference_must_be_canonical_ndc_ref"), true);
+assert.throws(
+  () => normalizeNdcCredentialReference({
+    owner: "device_core",
+    reference: "ndc-credref:provider-example-0001",
+  }),
+  /ndc_credential_reference_owner_invalid/,
+);
 assert.equal(validateCollectionProfile(geliosPositionsCurrentExample.collectionProfile).ok, true);
 assert.equal(validateDataProduct(geliosPositionsCurrentExample.dataProduct).ok, true);
 assert.equal(validateFoundryBinding(geliosPositionsCurrentExample.foundryBinding).ok, true);