106 lines
3.0 KiB
JavaScript
106 lines
3.0 KiB
JavaScript
import assert from "node:assert/strict";
|
|
import test from "node:test";
|
|
|
|
import {
|
|
DEVICE_SENSITIVE_REFERENCE_COMMAND_KINDS,
|
|
normalizeSensitiveReferenceManagementCommand,
|
|
} from "../src/sensitive-reference-management.mjs";
|
|
import {
|
|
ALL_DEVICE_MANAGEMENT_COMMAND_KINDS,
|
|
normalizeDeviceManagementCommand,
|
|
} from "../src/management-command.mjs";
|
|
|
|
const projectRef = "project:11111111-1111-4111-8111-111111111111";
|
|
const deviceRef = "device:22222222-2222-4222-8222-222222222222";
|
|
|
|
test("credential binding commands share the strict management surface", () => {
|
|
for (const kind of DEVICE_SENSITIVE_REFERENCE_COMMAND_KINDS) {
|
|
assert.equal(ALL_DEVICE_MANAGEMENT_COMMAND_KINDS.includes(kind), true);
|
|
}
|
|
assert.equal(
|
|
normalizeDeviceManagementCommand(
|
|
"device_credential_binding.upsert",
|
|
upsertInput(),
|
|
).projectId,
|
|
projectRef.slice("project:".length),
|
|
);
|
|
});
|
|
|
|
test("credential binding accepts only the platform canonical opaque ref", () => {
|
|
const command = normalizeSensitiveReferenceManagementCommand(
|
|
"device_credential_binding.upsert",
|
|
upsertInput(),
|
|
);
|
|
|
|
assert.deepEqual(command.credentialRef, {
|
|
owner: "ndc_l2_credentials",
|
|
reference: "ndc-credref:pilot-command-0001",
|
|
});
|
|
assert.equal(Object.isFrozen(command.credentialRef), true);
|
|
assert.throws(
|
|
() => normalizeSensitiveReferenceManagementCommand(
|
|
"device_credential_binding.upsert",
|
|
{
|
|
...upsertInput(),
|
|
credentialRef: {
|
|
owner: "device_core",
|
|
reference: "ndc-credref:pilot-command-0001",
|
|
},
|
|
},
|
|
),
|
|
/ndc_credential_reference_owner_invalid/,
|
|
);
|
|
assert.throws(
|
|
() => normalizeSensitiveReferenceManagementCommand(
|
|
"device_credential_binding.upsert",
|
|
{
|
|
...upsertInput(),
|
|
credentialRef: {
|
|
owner: "ndc_l2_credentials",
|
|
reference: "Bearer plaintext-is-forbidden",
|
|
},
|
|
},
|
|
),
|
|
/ndc_credential_reference_value_invalid/,
|
|
);
|
|
});
|
|
|
|
test("credential binding rejects raw secret-shaped fields", () => {
|
|
for (const field of ["password", "token", "secretValue", "endpoint"]) {
|
|
assert.throws(
|
|
() => normalizeSensitiveReferenceManagementCommand(
|
|
"device_credential_binding.upsert",
|
|
{ ...upsertInput(), [field]: "forbidden" },
|
|
),
|
|
new RegExp(`device_management_command_field_unexpected:${field}`),
|
|
);
|
|
}
|
|
});
|
|
|
|
test("credential revoke has no credential reference input", () => {
|
|
const command = normalizeSensitiveReferenceManagementCommand(
|
|
"device_credential_binding.revoke",
|
|
{
|
|
projectRef,
|
|
deviceRef,
|
|
purpose: "tracker.command",
|
|
resolutionCode: "operator.rotation",
|
|
},
|
|
);
|
|
|
|
assert.equal(command.resolutionCode, "operator.rotation");
|
|
assert.equal("credentialRef" in command, false);
|
|
});
|
|
|
|
function upsertInput() {
|
|
return {
|
|
projectRef,
|
|
deviceRef,
|
|
purpose: "tracker.command",
|
|
credentialRef: {
|
|
owner: "ndc_l2_credentials",
|
|
reference: "ndc-credref:pilot-command-0001",
|
|
},
|
|
};
|
|
}
|