feat(device-edge): add canonical core channel deployment

2026-08-11 20:00:58 +03:00
parent 1124c15216
commit 6461e7fca8
8 changed files with 877 additions and 14 deletions
@@ -0,0 +1,46 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+
+import { normalizeRuntimeDocument } from "../src/server.mjs";
+
+const fingerprint = Array.from({ length: 32 }, () => "AB").join(":");
+
+test("runtime document accepts one generation-bound Core identity", () => {
+  const result = normalizeRuntimeDocument({
+    schemaVersion: "nodedc.device-edge.channel-runtime.v1",
+    edgeRegistrationId: "edge:moscow-vps-1",
+    channelGeneration: "channel:1",
+    trustGeneration: "trust:1",
+    allowedCoreFingerprints: [fingerprint],
+  });
+
+  assert.equal(result.edgeRegistrationId, "edge:moscow-vps-1");
+  assert.deepEqual(result.allowedCoreFingerprints, [fingerprint]);
+});
+
+test("runtime document rejects hidden authority and missing identity", () => {
+  assert.throws(() => normalizeRuntimeDocument({
+    schemaVersion: "nodedc.device-edge.channel-runtime.v1",
+    edgeRegistrationId: "edge:moscow-vps-1",
+    channelGeneration: "channel:1",
+    trustGeneration: "trust:1",
+    allowedCoreFingerprints: [fingerprint],
+    endpoint: "https://attacker.invalid",
+  }), /runtime_config_key_invalid/);
+
+  assert.throws(() => normalizeRuntimeDocument({
+    schemaVersion: "nodedc.device-edge.channel-runtime.v1",
+    edgeRegistrationId: "edge:moscow-vps-1",
+    channelGeneration: "channel:1",
+    trustGeneration: "trust:1",
+    allowedCoreFingerprints: [],
+  }), /runtime_core_identity_invalid/);
+
+  assert.throws(() => normalizeRuntimeDocument({
+    schemaVersion: "nodedc.device-edge.channel-runtime.v1",
+    edgeRegistrationId: "edge:moscow-vps-1",
+    channelGeneration: "channel:1",
+    trustGeneration: "trust:1",
+    allowedCoreFingerprints: [fingerprint, fingerprint],
+  }), /runtime_core_identity_invalid/);
+});