feat(device-core): protect enrollment identifiers

device-plane/services/device-control-core/src/app.mjs

@@ -4,7 +4,9 @@ import { createServer } from "node:http";
 import {
   assertSafeProjection,
   hashRestrictedIdentifier,
+  maskRestrictedIdentifier,
   normalizeDiscoverySignal,
+  normalizeRestrictedIdentifier,
   toSafeDiscoveryView,
 } from "../../../packages/device-protocol-contract/src/index.mjs";
 import {
@@ -76,6 +78,9 @@ export function createControlCoreApp({
     if (typeof managementToken !== "string" || managementToken.length < 32) {
       throw new TypeError("device_management_token_invalid");
     }
+    if (typeof identifierPepper !== "string" || identifierPepper.length < 32) {
+      throw new TypeError("device_identifier_pepper_invalid");
+    }
   }
 
   const server = createServer(async (request, response) => {
@@ -121,9 +126,12 @@ export function createControlCoreApp({
         );
         const actor = managementActorFromHeaders(request.headers);
         const input = await readJsonBody(request, 64 * 1024);
+        const protectedInput = managementCommandKind === "enrollment_intent.ensure"
+          ? protectEnrollmentIdentifier(input, identifierPepper)
+          : input;
         const command = normalizeDeviceManagementCommand(
           managementCommandKind,
-          input,
+          protectedInput,
         );
         const requestDigest = managementRequestDigest({
           actor,
@@ -263,6 +271,38 @@ export function createControlCoreApp({
   return server;
 }
 
+function protectEnrollmentIdentifier(input, identifierPepper) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) {
+    throw new TypeError("device_enrollment_input_invalid");
+  }
+  const allowedKeys = new Set([
+    "projectRef",
+    "enrollmentKey",
+    "routeRef",
+    "modelProfileRef",
+    "displayName",
+    "identifier",
+    "expiresAt",
+  ]);
+  for (const key of Object.keys(input)) {
+    if (!allowedKeys.has(key)) {
+      throw new TypeError("device_enrollment_input_field_unexpected");
+    }
+  }
+  const identifier = normalizeRestrictedIdentifier(input.identifier);
+  return Object.freeze({
+    projectRef: input.projectRef,
+    enrollmentKey: input.enrollmentKey,
+    routeRef: input.routeRef,
+    modelProfileRef: input.modelProfileRef,
+    displayName: input.displayName,
+    identifierKind: identifier.kind,
+    identifierDigest: hashRestrictedIdentifier(identifier, identifierPepper),
+    identifierMasked: maskRestrictedIdentifier(identifier),
+    expiresAt: input.expiresAt,
+  });
+}
+
 function projectWorkspaceId(pathname) {
   const match = pathname.match(
     /^\/internal\/v1\/query\/projects\/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})\/workspace$/i,

device-plane/services/device-control-core/src/infrastructure-repository.mjs

@@ -73,6 +73,13 @@ async function ensureAdapterPackage(client, actor, command) {
       lifecycle_state = excluded.lifecycle_state,
       updated_at = now()
     where device_adapter_packages.publisher_ref = excluded.publisher_ref
+      and (
+        device_adapter_packages.lifecycle_state = excluded.lifecycle_state
+        or (
+          device_adapter_packages.lifecycle_state = 'active'
+          and excluded.lifecycle_state = 'retired'
+        )
+      )
     returning id, package_key, display_name, publisher_ref, lifecycle_state,
       created_at, updated_at, (xmax = 0) as created`,
     [
@@ -135,6 +142,17 @@ async function registerAdapterVersion(client, actor, command) {
       and device_adapter_versions.content_digest = excluded.content_digest
       and device_adapter_versions.contract_version = excluded.contract_version
       and device_adapter_versions.capabilities = excluded.capabilities
+      and (
+        device_adapter_versions.lifecycle_state = excluded.lifecycle_state
+        or (
+          device_adapter_versions.lifecycle_state = 'draft'
+          and excluded.lifecycle_state in ('active', 'retired')
+        )
+        or (
+          device_adapter_versions.lifecycle_state = 'active'
+          and excluded.lifecycle_state = 'retired'
+        )
+      )
     returning id, adapter_package_id, version, runtime_package_ref,
       content_digest, contract_version, capabilities, lifecycle_state,
       created_at, updated_at, (xmax = 0) as created`,
@@ -231,6 +249,17 @@ async function registerModelProfile(client, actor, command) {
       and device_model_profiles.schema_artifact_ref = excluded.schema_artifact_ref
       and device_model_profiles.profile_digest = excluded.profile_digest
       and device_model_profiles.capabilities = excluded.capabilities
+      and (
+        device_model_profiles.lifecycle_state = excluded.lifecycle_state
+        or (
+          device_model_profiles.lifecycle_state = 'draft'
+          and excluded.lifecycle_state in ('active', 'retired')
+        )
+        or (
+          device_model_profiles.lifecycle_state = 'active'
+          and excluded.lifecycle_state = 'retired'
+        )
+      )
     returning profile_ref, schema_version, vendor, model, device_type,
       protocol, adapter_version_id, schema_artifact_ref, profile_digest,
       capabilities, lifecycle_state, created_at, updated_at,
@@ -289,6 +318,20 @@ async function ensureEdge(client, actor, command) {
       deployment_ref = excluded.deployment_ref,
       lifecycle_state = excluded.lifecycle_state,
       updated_at = now()
+    where
+      device_edges.lifecycle_state = excluded.lifecycle_state
+      or (
+        device_edges.lifecycle_state = 'provisioning'
+        and excluded.lifecycle_state in ('active', 'retired')
+      )
+      or (
+        device_edges.lifecycle_state = 'active'
+        and excluded.lifecycle_state in ('suspended', 'retired')
+      )
+      or (
+        device_edges.lifecycle_state = 'suspended'
+        and excluded.lifecycle_state in ('active', 'retired')
+      )
     returning id, edge_key, display_name, deployment_ref, lifecycle_state,
       created_at, updated_at, (xmax = 0) as created`,
     [
@@ -351,6 +394,20 @@ async function ensureRoute(client, actor, command) {
       direction = excluded.direction,
       lifecycle_state = excluded.lifecycle_state,
       updated_at = now()
+    where
+      device_routes.lifecycle_state = excluded.lifecycle_state
+      or (
+        device_routes.lifecycle_state = 'draft'
+        and excluded.lifecycle_state in ('active', 'retired')
+      )
+      or (
+        device_routes.lifecycle_state = 'active'
+        and excluded.lifecycle_state in ('suspended', 'retired')
+      )
+      or (
+        device_routes.lifecycle_state = 'suspended'
+        and excluded.lifecycle_state in ('active', 'retired')
+      )
     returning id, project_id, route_key, display_name, edge_id,
       model_profile_ref, listener_ref, protocol, direction, lifecycle_state,
       created_at, updated_at, (xmax = 0) as created`,

device-plane/services/device-control-core/src/server.mjs

@@ -67,7 +67,7 @@ async function readConfig() {
           "device_gateway_core_token_file_required",
         )
       : "",
-    identifierPepper: discoveryIngestEnabled
+    identifierPepper: discoveryIngestEnabled || managementApiEnabled
       ? await readRequiredSecretFile(
           process.env.DEVICE_IDENTIFIER_PEPPER_FILE,
           "device_identifier_pepper_file_required",