feat(device-edge): open bounded tracker ingress

2026-08-12 15:10:27 +03:00
parent 6fd172ecc5
commit 606872edcc
9 changed files with 717 additions and 3 deletions
@@ -0,0 +1,32 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+
+import {
+  normalizeTrackerIngressConfiguration,
+} from "../../../vps/edge-process/device-edge-runtime.mjs";
+
+test("VPS tracker ingress resolves one allowlisted profile within bounded limits", () => {
+  const config = normalizeTrackerIngressConfiguration({}, "edge:moscow-vps-1");
+
+  assert.equal(config.protocolProfileRef, "arusnavi.b2.internal.v1");
+  assert.equal(config.tcpHost, "0.0.0.0");
+  assert.equal(config.tcpPort, 9921);
+  assert.equal(config.maxConcurrentSessions, 128);
+  assert.equal(config.maxSessionsPerAddress, 16);
+  assert.equal(config.maxConnectionsPerMinutePerAddress, 60);
+  assert.equal(config.maxAggregateBufferedBytes, 32 * 1024 * 1024);
+});
+
+test("VPS tracker ingress rejects hidden bind and non-allowlisted adapters", () => {
+  assert.throws(() => normalizeTrackerIngressConfiguration({
+    DEVICE_GATEWAY_TCP_HOST: "127.0.0.1",
+  }, "edge:moscow-vps-1"), /public_host_invalid/);
+
+  assert.throws(() => normalizeTrackerIngressConfiguration({
+    DEVICE_GATEWAY_PROTOCOL_PROFILE_REF: "vendor.unknown.v1",
+  }, "edge:moscow-vps-1"), /profile_not_allowlisted/);
+
+  assert.throws(() => normalizeTrackerIngressConfiguration({
+    DEVICE_GATEWAY_MAX_SESSIONS: "129",
+  }, "edge:moscow-vps-1"), /session_limit_invalid/);
+});