feat(device-core): add idempotent project management

2026-08-10 17:27:07 +03:00
parent 336602c7ca
commit 70bafdd028
10 changed files with 2260 additions and 2 deletions
@@ -0,0 +1,44 @@
+import assert from "node:assert/strict";
+import { readFile } from "node:fs/promises";
+import test from "node:test";
+
+const appUrl = new URL("../src/app.mjs", import.meta.url);
+const serverUrl = new URL("../src/server.mjs", import.meta.url);
+const repositoryUrl = new URL("../src/postgres-repository.mjs", import.meta.url);
+const composeUrl = new URL("../../../docker-compose.device-plane.yml", import.meta.url);
+
+test("management surface is internal, POST-only and disabled by default", async () => {
+  const source = await readFile(appUrl, "utf8");
+
+  assert.match(source, /managementApiEnabled = false/);
+  assert.match(source, /\/internal\/v1\/management\/owner-scopes:ensure/);
+  assert.match(source, /\/internal\/v1\/management\/projects:ensure/);
+  assert.match(source, /\/internal\/v1\/management\/collections:ensure/);
+  assert.match(source, /\/internal\/v1\/management\/project-grants:upsert/);
+  assert.match(source, /request\.method === "POST" && managementCommandKind/);
+  assert.doesNotMatch(source, /\/api\/public\/.*management/);
+});
+
+test("management token remains file-backed and is not enabled by current Compose", async () => {
+  const server = await readFile(serverUrl, "utf8");
+  const compose = await readFile(composeUrl, "utf8");
+
+  assert.match(server, /DEVICE_MANAGEMENT_API_ENABLED/);
+  assert.match(server, /DEVICE_MANAGEMENT_CORE_TOKEN_FILE/);
+  assert.doesNotMatch(compose, /DEVICE_MANAGEMENT_API_ENABLED/);
+  assert.doesNotMatch(compose, /DEVICE_MANAGEMENT_CORE_TOKEN_FILE/);
+});
+
+test("repository pins idempotency, audit and last-owner checks inside one transaction", async () => {
+  const source = await readFile(repositoryUrl, "utf8");
+
+  assert.match(source, /await client\.query\("begin"\)/);
+  assert.match(source, /await client\.query\("commit"\)/);
+  assert.match(source, /await client\.query\("rollback"\)/);
+  assert.match(source, /device_idempotency_key_conflict/);
+  assert.match(source, /device_project_last_owner_required/);
+  assert.match(source, /for update of p/);
+  assert.match(source, /authorizeManagementReplay/);
+  assert.match(source, /insert into device_audit_events/);
+  assert.match(source, /update device_management_command_receipts/);
+});