323 lines
9.5 KiB
JavaScript
323 lines
9.5 KiB
JavaScript
import assert from "node:assert/strict";
|
|
import test from "node:test";
|
|
|
|
import { createControlCoreApp } from "../src/app.mjs";
|
|
|
|
const managementToken = "test-only-management-token-with-32-bytes";
|
|
const identifierPepper = "test-only-identifier-pepper-with-32-bytes";
|
|
|
|
test("management API forwards a normalized generic Edge registration", async () => {
|
|
let executed;
|
|
const runtime = await startServer({
|
|
managementApiEnabled: true,
|
|
managementToken,
|
|
repository: {
|
|
health: async () => "ready",
|
|
executeManagementCommand: async (input) => {
|
|
executed = input;
|
|
return { replayed: false, result: { created: true } };
|
|
},
|
|
},
|
|
});
|
|
try {
|
|
const response = await fetch(
|
|
`${runtime.baseUrl}/internal/v1/management/edges:ensure`,
|
|
{
|
|
method: "POST",
|
|
headers: managementHeaders(),
|
|
body: JSON.stringify({
|
|
edgeKey: "generic-edge",
|
|
displayName: "Generic Edge",
|
|
deploymentRef: "deployment:device-edge/pilot",
|
|
}),
|
|
},
|
|
);
|
|
|
|
assert.equal(response.status, 200);
|
|
assert.equal(executed.commandKind, "edge.ensure");
|
|
assert.deepEqual(executed.command, {
|
|
edgeKey: "generic-edge",
|
|
displayName: "Generic Edge",
|
|
deploymentRef: "deployment:device-edge/pilot",
|
|
lifecycleState: "provisioning",
|
|
});
|
|
assert.equal(executed.actor.hubRole, "owner");
|
|
} finally {
|
|
await runtime.close();
|
|
}
|
|
});
|
|
|
|
test("management API exposes no user-owned session mutation", async () => {
|
|
let executions = 0;
|
|
const runtime = await startServer({
|
|
managementApiEnabled: true,
|
|
managementToken,
|
|
repository: {
|
|
health: async () => "ready",
|
|
executeManagementCommand: async () => {
|
|
executions += 1;
|
|
return { replayed: false, result: {} };
|
|
},
|
|
},
|
|
});
|
|
try {
|
|
const response = await fetch(
|
|
`${runtime.baseUrl}/internal/v1/management/sessions:ensure`,
|
|
{
|
|
method: "POST",
|
|
headers: managementHeaders(),
|
|
body: "{}",
|
|
},
|
|
);
|
|
|
|
assert.equal(response.status, 404);
|
|
assert.equal(executions, 0);
|
|
} finally {
|
|
await runtime.close();
|
|
}
|
|
});
|
|
|
|
test("management API forwards claim as evidence references without identity input", async () => {
|
|
let executed;
|
|
const runtime = await startServer({
|
|
managementApiEnabled: true,
|
|
managementToken,
|
|
repository: {
|
|
health: async () => "ready",
|
|
executeManagementCommand: async (input) => {
|
|
executed = input;
|
|
return { replayed: false, result: { created: true } };
|
|
},
|
|
},
|
|
});
|
|
try {
|
|
const response = await fetch(
|
|
`${runtime.baseUrl}/internal/v1/management/devices:claim`,
|
|
{
|
|
method: "POST",
|
|
headers: managementHeaders(),
|
|
body: JSON.stringify({
|
|
projectRef: "project:11111111-1111-4111-8111-111111111111",
|
|
enrollmentIntentRef:
|
|
"enrollment-intent:22222222-2222-4222-8222-222222222222",
|
|
discoveryRef: "discovery:33333333-3333-4333-8333-333333333333",
|
|
deviceKey: "pilot-device",
|
|
displayName: "Pilot device",
|
|
}),
|
|
},
|
|
);
|
|
|
|
assert.equal(response.status, 200);
|
|
assert.equal(executed.commandKind, "device.claim");
|
|
assert.equal(executed.command.deviceKey, "pilot-device");
|
|
assert.equal("identifier" in executed.command, false);
|
|
assert.equal("credentialRef" in executed.command, false);
|
|
} finally {
|
|
await runtime.close();
|
|
}
|
|
});
|
|
|
|
test("management API derives enrollment identity inside Core and never forwards raw IMEI", async () => {
|
|
let executed;
|
|
const runtime = await startServer({
|
|
managementApiEnabled: true,
|
|
managementToken,
|
|
repository: {
|
|
health: async () => "ready",
|
|
executeManagementCommand: async (input) => {
|
|
executed = input;
|
|
return {
|
|
replayed: false,
|
|
result: {
|
|
enrollmentIntent: {
|
|
identifier: {
|
|
kind: input.command.identifierKind,
|
|
masked: input.command.identifierMasked,
|
|
},
|
|
},
|
|
},
|
|
};
|
|
},
|
|
},
|
|
});
|
|
try {
|
|
const rawImei = "123456789012345";
|
|
const response = await fetch(
|
|
`${runtime.baseUrl}/internal/v1/management/enrollment-intents:ensure`,
|
|
{
|
|
method: "POST",
|
|
headers: {
|
|
...managementHeaders(),
|
|
"Idempotency-Key": "phase25-enrollment-0001",
|
|
},
|
|
body: JSON.stringify({
|
|
projectRef: "project:11111111-1111-4111-8111-111111111111",
|
|
enrollmentKey: "pilot-device",
|
|
routeRef: "route:22222222-2222-4222-8222-222222222222",
|
|
modelProfileRef: "arusnavi.b2.v1",
|
|
displayName: "Pilot device",
|
|
identifier: { kind: "imei", value: rawImei },
|
|
expiresAt: null,
|
|
}),
|
|
},
|
|
);
|
|
|
|
const body = await response.json();
|
|
assert.equal(response.status, 200);
|
|
assert.equal(executed.command.identifierKind, "imei");
|
|
assert.equal(executed.command.identifierMasked, "***********2345");
|
|
assert.match(executed.command.identifierDigest, /^hmac-sha256:[a-f0-9]{64}$/);
|
|
assert.equal(JSON.stringify(executed).includes(rawImei), false);
|
|
assert.equal(JSON.stringify(body).includes(rawImei), false);
|
|
} finally {
|
|
await runtime.close();
|
|
}
|
|
});
|
|
|
|
test("management API rejects client-supplied enrollment digests", async () => {
|
|
let executions = 0;
|
|
const runtime = await startServer({
|
|
managementApiEnabled: true,
|
|
managementToken,
|
|
repository: {
|
|
health: async () => "ready",
|
|
executeManagementCommand: async () => {
|
|
executions += 1;
|
|
return { replayed: false, result: {} };
|
|
},
|
|
},
|
|
});
|
|
try {
|
|
const response = await fetch(
|
|
`${runtime.baseUrl}/internal/v1/management/enrollment-intents:ensure`,
|
|
{
|
|
method: "POST",
|
|
headers: {
|
|
...managementHeaders(),
|
|
"Idempotency-Key": "phase25-enrollment-reject-0001",
|
|
},
|
|
body: JSON.stringify({
|
|
projectRef: "project:11111111-1111-4111-8111-111111111111",
|
|
enrollmentKey: "pilot-device",
|
|
routeRef: "route:22222222-2222-4222-8222-222222222222",
|
|
modelProfileRef: "arusnavi.b2.v1",
|
|
displayName: "Pilot device",
|
|
identifier: { kind: "imei", value: "123456789012345" },
|
|
identifierDigest: `hmac-sha256:${"a".repeat(64)}`,
|
|
}),
|
|
},
|
|
);
|
|
assert.equal(response.status, 400);
|
|
assert.equal(
|
|
(await response.json()).error,
|
|
"device_enrollment_input_field_unexpected",
|
|
);
|
|
assert.equal(executions, 0);
|
|
} finally {
|
|
await runtime.close();
|
|
}
|
|
});
|
|
|
|
test("management API accepts only a canonical credential reference", async () => {
|
|
let executed;
|
|
const runtime = await startServer({
|
|
managementApiEnabled: true,
|
|
managementToken,
|
|
repository: {
|
|
health: async () => "ready",
|
|
executeManagementCommand: async (input) => {
|
|
executed = input;
|
|
return {
|
|
replayed: false,
|
|
result: {
|
|
credentialBinding: {
|
|
credentialBindingRef:
|
|
"credential-binding:44444444-4444-4444-8444-444444444444",
|
|
},
|
|
},
|
|
};
|
|
},
|
|
},
|
|
});
|
|
try {
|
|
const response = await fetch(
|
|
`${runtime.baseUrl}/internal/v1/management/device-credential-bindings:upsert`,
|
|
{
|
|
method: "POST",
|
|
headers: managementHeaders(),
|
|
body: JSON.stringify({
|
|
projectRef: "project:11111111-1111-4111-8111-111111111111",
|
|
deviceRef: "device:22222222-2222-4222-8222-222222222222",
|
|
purpose: "tracker.command",
|
|
credentialRef: {
|
|
owner: "ndc_l2_credentials",
|
|
reference: "ndc-credref:pilot-command-0001",
|
|
},
|
|
}),
|
|
},
|
|
);
|
|
|
|
assert.equal(response.status, 200);
|
|
assert.equal(
|
|
executed.commandKind,
|
|
"device_credential_binding.upsert",
|
|
);
|
|
assert.deepEqual(executed.command.credentialRef, {
|
|
owner: "ndc_l2_credentials",
|
|
reference: "ndc-credref:pilot-command-0001",
|
|
});
|
|
|
|
const rejected = await fetch(
|
|
`${runtime.baseUrl}/internal/v1/management/device-credential-bindings:upsert`,
|
|
{
|
|
method: "POST",
|
|
headers: {
|
|
...managementHeaders(),
|
|
"Idempotency-Key": "phase24-credential-invalid-0001",
|
|
},
|
|
body: JSON.stringify({
|
|
projectRef: "project:11111111-1111-4111-8111-111111111111",
|
|
deviceRef: "device:22222222-2222-4222-8222-222222222222",
|
|
purpose: "tracker.command",
|
|
credentialRef: {
|
|
owner: "device_core",
|
|
reference: "ndc-credref:pilot-command-0001",
|
|
},
|
|
}),
|
|
},
|
|
);
|
|
assert.equal(rejected.status, 400);
|
|
assert.equal(
|
|
(await rejected.json()).error,
|
|
"ndc_credential_reference_owner_invalid",
|
|
);
|
|
} finally {
|
|
await runtime.close();
|
|
}
|
|
});
|
|
|
|
async function startServer(options) {
|
|
const server = createControlCoreApp({ identifierPepper, ...options });
|
|
await new Promise((resolve, reject) => {
|
|
server.once("error", reject);
|
|
server.listen(0, "127.0.0.1", resolve);
|
|
});
|
|
const address = server.address();
|
|
return {
|
|
baseUrl: `http://127.0.0.1:${address.port}`,
|
|
close: () => new Promise((resolve, reject) => {
|
|
server.close((error) => (error ? reject(error) : resolve()));
|
|
}),
|
|
};
|
|
}
|
|
|
|
function managementHeaders() {
|
|
return {
|
|
Authorization: `Bearer ${managementToken}`,
|
|
"Content-Type": "application/json",
|
|
"Idempotency-Key": "phase23-edge-0001",
|
|
"X-NODEDC-User-Ref": "user:platform-owner",
|
|
"X-NODEDC-Hub-Role": "owner",
|
|
};
|
|
}
|