feat(device-plane): add fail-closed deploy foundation

2026-07-25 21:29:05 +03:00
parent e9e03143cd
commit e217723784
36 changed files with 3729 additions and 0 deletions
@@ -0,0 +1,32 @@
+import assert from "node:assert/strict";
+import { readFile } from "node:fs/promises";
+import test from "node:test";
+
+const migrationUrl = new URL(
+  "../migrations/001_device_plane_foundation.sql",
+  import.meta.url,
+);
+
+test("foundation migration keeps restricted identifiers hashed and DB private", async () => {
+  const sql = await readFile(migrationUrl, "utf8");
+  assert.match(sql, /identifier_digest text not null/);
+  assert.match(sql, /identifier_masked text not null/);
+  assert.doesNotMatch(sql, /imei\s+text/i);
+  assert.doesNotMatch(sql, /password\s+text/i);
+  assert.doesNotMatch(sql, /raw_packet/i);
+});
+
+test("foundation migration has quarantine, contour, binding and audit tables", async () => {
+  const sql = await readFile(migrationUrl, "utf8");
+  for (const table of [
+    "device_model_profiles",
+    "device_contours",
+    "device_discoveries",
+    "device_instances",
+    "device_bindings",
+    "device_audit_events",
+  ]) {
+    assert.match(sql, new RegExp(`create table if not exists ${table}`));
+  }
+  assert.match(sql, /default 'quarantine'/);
+});