feat(edp): provision Foundry reader grants

services/external-data-plane/test/reader-binding.test.mjs

@@ -1,11 +1,15 @@
 import assert from "node:assert/strict";
 import {
   assertReaderProduct,
+  consumerReaderBindingRequestHash,
   createReaderToken,
   hashReaderToken,
+  normalizeManagedConsumerReaderBindingRequest,
+  normalizeManagedConsumerReaderPlanRequest,
   normalizeManagedReaderBindingRequest,
   normalizeReaderBindingRequest,
   readerBindingRequestHash,
+  safeManagedConsumerReaderBinding,
   safeReaderBinding,
 } from "../src/reader-binding.mjs";
 
@@ -64,4 +68,31 @@ assert.throws(() => normalizeManagedReaderBindingRequest({
   capabilityDigest: managed.capabilityDigest,
 }), /managed_reader_binding_must_be_durable/);
 
+const consumerPlan = normalizeManagedConsumerReaderPlanRequest({
+  allowedDataProductIds: ["fleet.positions.current.v1", "fleet.positions.current.v1"],
+});
+assert.deepEqual(consumerPlan.allowedDataProductIds, ["fleet.positions.current.v1"]);
+const consumerManaged = normalizeManagedConsumerReaderBindingRequest({
+  allowedDataProductIds: consumerPlan.allowedDataProductIds,
+  expiresAt: null,
+  generation: 1,
+  capabilityDigest: hashReaderToken(token),
+});
+assert.match(consumerReaderBindingRequestHash(consumerManaged), /^[a-f0-9]{64}$/);
+const safeConsumer = safeManagedConsumerReaderBinding({
+  id: "reader-foundry-01",
+  bindingKey: "fndrc-reader-managed",
+  ...consumerManaged,
+  active: true,
+});
+assert.equal(safeConsumer.sourceScope, "resolved-server-side");
+assert.equal(JSON.stringify(safeConsumer).includes(consumerManaged.capabilityDigest), false);
+assert.equal("tenantId" in safeConsumer, false);
+assert.equal("connectionId" in safeConsumer, false);
+assert.equal("providerId" in safeConsumer, false);
+assert.throws(() => normalizeManagedConsumerReaderBindingRequest({
+  ...consumerManaged,
+  capability: "forbidden",
+}), /managed_consumer_reader_binding_request_invalid/);
+
 console.log("external-data-plane reader bindings: ok");