NODEDC_PLATFORM/device-plane/services/device-control-core/test/infrastructure-app.test.mjs

import assert from "node:assert/strict";
import test from "node:test";

import { createControlCoreApp } from "../src/app.mjs";

const managementToken = "test-only-management-token-with-32-bytes";

test("management API forwards a normalized generic Edge registration", async () => {
  let executed;
  const runtime = await startServer({
    managementApiEnabled: true,
    managementToken,
    repository: {
      health: async () => "ready",
      executeManagementCommand: async (input) => {
        executed = input;
        return { replayed: false, result: { created: true } };
      },
    },
  });
  try {
    const response = await fetch(
      `${runtime.baseUrl}/internal/v1/management/edges:ensure`,
      {
        method: "POST",
        headers: managementHeaders(),
        body: JSON.stringify({
          edgeKey: "generic-edge",
          displayName: "Generic Edge",
          deploymentRef: "deployment:device-edge/pilot",
        }),
      },
    );

    assert.equal(response.status, 200);
    assert.equal(executed.commandKind, "edge.ensure");
    assert.deepEqual(executed.command, {
      edgeKey: "generic-edge",
      displayName: "Generic Edge",
      deploymentRef: "deployment:device-edge/pilot",
      lifecycleState: "provisioning",
    });
    assert.equal(executed.actor.hubRole, "owner");
  } finally {
    await runtime.close();
  }
});

test("management API exposes no user-owned session mutation", async () => {
  let executions = 0;
  const runtime = await startServer({
    managementApiEnabled: true,
    managementToken,
    repository: {
      health: async () => "ready",
      executeManagementCommand: async () => {
        executions += 1;
        return { replayed: false, result: {} };
      },
    },
  });
  try {
    const response = await fetch(
      `${runtime.baseUrl}/internal/v1/management/sessions:ensure`,
      {
        method: "POST",
        headers: managementHeaders(),
        body: "{}",
      },
    );

    assert.equal(response.status, 404);
    assert.equal(executions, 0);
  } finally {
    await runtime.close();
  }
});

test("management API forwards claim as evidence references without identity input", async () => {
  let executed;
  const runtime = await startServer({
    managementApiEnabled: true,
    managementToken,
    repository: {
      health: async () => "ready",
      executeManagementCommand: async (input) => {
        executed = input;
        return { replayed: false, result: { created: true } };
      },
    },
  });
  try {
    const response = await fetch(
      `${runtime.baseUrl}/internal/v1/management/devices:claim`,
      {
        method: "POST",
        headers: managementHeaders(),
        body: JSON.stringify({
          projectRef: "project:11111111-1111-4111-8111-111111111111",
          enrollmentIntentRef:
            "enrollment-intent:22222222-2222-4222-8222-222222222222",
          discoveryRef: "discovery:33333333-3333-4333-8333-333333333333",
          deviceKey: "pilot-device",
          displayName: "Pilot device",
        }),
      },
    );

    assert.equal(response.status, 200);
    assert.equal(executed.commandKind, "device.claim");
    assert.equal(executed.command.deviceKey, "pilot-device");
    assert.equal("identifier" in executed.command, false);
    assert.equal("credentialRef" in executed.command, false);
  } finally {
    await runtime.close();
  }
});

test("management API accepts only a canonical credential reference", async () => {
  let executed;
  const runtime = await startServer({
    managementApiEnabled: true,
    managementToken,
    repository: {
      health: async () => "ready",
      executeManagementCommand: async (input) => {
        executed = input;
        return {
          replayed: false,
          result: {
            credentialBinding: {
              credentialBindingRef:
                "credential-binding:44444444-4444-4444-8444-444444444444",
            },
          },
        };
      },
    },
  });
  try {
    const response = await fetch(
      `${runtime.baseUrl}/internal/v1/management/device-credential-bindings:upsert`,
      {
        method: "POST",
        headers: managementHeaders(),
        body: JSON.stringify({
          projectRef: "project:11111111-1111-4111-8111-111111111111",
          deviceRef: "device:22222222-2222-4222-8222-222222222222",
          purpose: "tracker.command",
          credentialRef: {
            owner: "ndc_l2_credentials",
            reference: "ndc-credref:pilot-command-0001",
          },
        }),
      },
    );

    assert.equal(response.status, 200);
    assert.equal(
      executed.commandKind,
      "device_credential_binding.upsert",
    );
    assert.deepEqual(executed.command.credentialRef, {
      owner: "ndc_l2_credentials",
      reference: "ndc-credref:pilot-command-0001",
    });

    const rejected = await fetch(
      `${runtime.baseUrl}/internal/v1/management/device-credential-bindings:upsert`,
      {
        method: "POST",
        headers: {
          ...managementHeaders(),
          "Idempotency-Key": "phase24-credential-invalid-0001",
        },
        body: JSON.stringify({
          projectRef: "project:11111111-1111-4111-8111-111111111111",
          deviceRef: "device:22222222-2222-4222-8222-222222222222",
          purpose: "tracker.command",
          credentialRef: {
            owner: "device_core",
            reference: "ndc-credref:pilot-command-0001",
          },
        }),
      },
    );
    assert.equal(rejected.status, 400);
    assert.equal(
      (await rejected.json()).error,
      "ndc_credential_reference_owner_invalid",
    );
  } finally {
    await runtime.close();
  }
});

async function startServer(options) {
  const server = createControlCoreApp(options);
  await new Promise((resolve, reject) => {
    server.once("error", reject);
    server.listen(0, "127.0.0.1", resolve);
  });
  const address = server.address();
  return {
    baseUrl: `http://127.0.0.1:${address.port}`,
    close: () => new Promise((resolve, reject) => {
      server.close((error) => (error ? reject(error) : resolve()));
    }),
  };
}

function managementHeaders() {
  return {
    Authorization: `Bearer ${managementToken}`,
    "Content-Type": "application/json",
    "Idempotency-Key": "phase23-edge-0001",
    "X-NODEDC-User-Ref": "user:platform-owner",
    "X-NODEDC-Hub-Role": "owner",
  };
}