feat(device-core): protect enrollment identifiers

device-plane/services/device-control-core/test/infrastructure-app.test.mjs

@@ -4,6 +4,7 @@ import test from "node:test";
 import { createControlCoreApp } from "../src/app.mjs";
 
 const managementToken = "test-only-management-token-with-32-bytes";
+const identifierPepper = "test-only-identifier-pepper-with-32-bytes";
 
 test("management API forwards a normalized generic Edge registration", async () => {
   let executed;
@@ -116,6 +117,107 @@ test("management API forwards claim as evidence references without identity inpu
   }
 });
 
+test("management API derives enrollment identity inside Core and never forwards raw IMEI", async () => {
+  let executed;
+  const runtime = await startServer({
+    managementApiEnabled: true,
+    managementToken,
+    repository: {
+      health: async () => "ready",
+      executeManagementCommand: async (input) => {
+        executed = input;
+        return {
+          replayed: false,
+          result: {
+            enrollmentIntent: {
+              identifier: {
+                kind: input.command.identifierKind,
+                masked: input.command.identifierMasked,
+              },
+            },
+          },
+        };
+      },
+    },
+  });
+  try {
+    const rawImei = "123456789012345";
+    const response = await fetch(
+      `${runtime.baseUrl}/internal/v1/management/enrollment-intents:ensure`,
+      {
+        method: "POST",
+        headers: {
+          ...managementHeaders(),
+          "Idempotency-Key": "phase25-enrollment-0001",
+        },
+        body: JSON.stringify({
+          projectRef: "project:11111111-1111-4111-8111-111111111111",
+          enrollmentKey: "pilot-device",
+          routeRef: "route:22222222-2222-4222-8222-222222222222",
+          modelProfileRef: "arusnavi.b2.v1",
+          displayName: "Pilot device",
+          identifier: { kind: "imei", value: rawImei },
+          expiresAt: null,
+        }),
+      },
+    );
+
+    const body = await response.json();
+    assert.equal(response.status, 200);
+    assert.equal(executed.command.identifierKind, "imei");
+    assert.equal(executed.command.identifierMasked, "***********2345");
+    assert.match(executed.command.identifierDigest, /^hmac-sha256:[a-f0-9]{64}$/);
+    assert.equal(JSON.stringify(executed).includes(rawImei), false);
+    assert.equal(JSON.stringify(body).includes(rawImei), false);
+  } finally {
+    await runtime.close();
+  }
+});
+
+test("management API rejects client-supplied enrollment digests", async () => {
+  let executions = 0;
+  const runtime = await startServer({
+    managementApiEnabled: true,
+    managementToken,
+    repository: {
+      health: async () => "ready",
+      executeManagementCommand: async () => {
+        executions += 1;
+        return { replayed: false, result: {} };
+      },
+    },
+  });
+  try {
+    const response = await fetch(
+      `${runtime.baseUrl}/internal/v1/management/enrollment-intents:ensure`,
+      {
+        method: "POST",
+        headers: {
+          ...managementHeaders(),
+          "Idempotency-Key": "phase25-enrollment-reject-0001",
+        },
+        body: JSON.stringify({
+          projectRef: "project:11111111-1111-4111-8111-111111111111",
+          enrollmentKey: "pilot-device",
+          routeRef: "route:22222222-2222-4222-8222-222222222222",
+          modelProfileRef: "arusnavi.b2.v1",
+          displayName: "Pilot device",
+          identifier: { kind: "imei", value: "123456789012345" },
+          identifierDigest: `hmac-sha256:${"a".repeat(64)}`,
+        }),
+      },
+    );
+    assert.equal(response.status, 400);
+    assert.equal(
+      (await response.json()).error,
+      "device_enrollment_input_field_unexpected",
+    );
+    assert.equal(executions, 0);
+  } finally {
+    await runtime.close();
+  }
+});
+
 test("management API accepts only a canonical credential reference", async () => {
   let executed;
   const runtime = await startServer({
@@ -195,7 +297,7 @@ test("management API accepts only a canonical credential reference", async () =>
 });
 
 async function startServer(options) {
-  const server = createControlCoreApp(options);
+  const server = createControlCoreApp({ identifierPepper, ...options });
   await new Promise((resolve, reject) => {
     server.once("error", reject);
     server.listen(0, "127.0.0.1", resolve);