feat(device-core): add authorized project read model

device-plane/services/device-control-core/test/app.test.mjs

@@ -237,6 +237,77 @@ test("management API exposes a repository idempotency conflict without retrying"
   }
 });
 
+test("project query is service-authenticated and forwards only the trusted actor", async () => {
+  let queriedActor;
+  const runtime = await startTestServer({
+    managementApiEnabled: true,
+    managementToken,
+    repository: {
+      health: async () => "ready",
+      executeManagementCommand: async () => ({ replayed: false, result: {} }),
+      listAccessibleProjects: async (actor) => {
+        queriedActor = actor;
+        return [{ projectRef: "project:11111111-1111-4111-8111-111111111111" }];
+      },
+    },
+  });
+  try {
+    const unauthorized = await fetch(
+      `${runtime.baseUrl}/internal/v1/query/projects`,
+    );
+    assert.equal(unauthorized.status, 401);
+
+    const response = await fetch(
+      `${runtime.baseUrl}/internal/v1/query/projects`,
+      { headers: managementHeaders() },
+    );
+    assert.equal(response.status, 200);
+    assert.equal((await response.json()).projects.length, 1);
+    assert.deepEqual(queriedActor, {
+      userRef: "user:engineer",
+      hubRole: "admin",
+      groupRefs: ["group:engineers", "group:operators"],
+      ownerScopes: [{ scopeKind: "company", ownerRef: "client:example" }],
+    });
+  } finally {
+    await runtime.close();
+  }
+});
+
+test("project workspace query accepts only a canonical project path", async () => {
+  const projectId = "11111111-1111-4111-8111-111111111111";
+  let queried;
+  const runtime = await startTestServer({
+    managementApiEnabled: true,
+    managementToken,
+    repository: {
+      health: async () => "ready",
+      executeManagementCommand: async () => ({ replayed: false, result: {} }),
+      getProjectWorkspace: async (actor, id) => {
+        queried = { actor, id };
+        return { project: { projectRef: `project:${id}` }, devices: [] };
+      },
+    },
+  });
+  try {
+    const response = await fetch(
+      `${runtime.baseUrl}/internal/v1/query/projects/${projectId}/workspace`,
+      { headers: managementHeaders() },
+    );
+    assert.equal(response.status, 200);
+    assert.equal((await response.json()).workspace.devices.length, 0);
+    assert.equal(queried.id, projectId);
+
+    const invalid = await fetch(
+      `${runtime.baseUrl}/internal/v1/query/projects/not-a-project/workspace`,
+      { headers: managementHeaders() },
+    );
+    assert.equal(invalid.status, 404);
+  } finally {
+    await runtime.close();
+  }
+});
+
 test("discovery ingest is closed by default", async () => {
   const runtime = await startTestServer({
     repository: {