deviceId: string,

) => {

const metadata = paired[deviceId];

expect(metadata).toBeTruthy();

if (!metadata) {

throw new Error(`Expected paired metadata for deviceId=${deviceId}`);

}

let device: Awaited<ReturnType<typeof createSignedDevice>>["device"] | null = null;

if (tc.withUnpairedNodeDevice) {

const challengeNonce = await readConnectChallengeNonce(ws);

expect(challengeNonce, tc.name).toBeTruthy();

if (!challengeNonce) {

throw new Error(`expected connect challenge nonce for ${tc.name}`);

}

({ device } = await createSignedDevice({

token: null,

role: "node",

await withControlUiGatewayServer(async ({ port }) => {

const staleDeviceWs = await openWs(port, { origin: originForPort(port) });

const challengeNonce = await readConnectChallengeNonce(staleDeviceWs);

expect(challengeNonce, "stale device challenge").toBeTruthy();

if (!challengeNonce) {

throw new Error("expected stale device challenge nonce");

}

const { device } = await createSignedDevice({

token: "secret",

scopes: [],

(entry) => entry.deviceId === identity.deviceId,

);

expect(pendingAfterRead).toHaveLength(0);

expect(await getPairedDevice(identity.deviceId)).toBeTruthy();

if (!(await getPairedDevice(identity.deviceId))) {

throw new Error(`expected paired device ${identity.deviceId}`);

}

wsRemoteRead.close();

const ws2 = await openWs(port, { host: "gateway.example" });

);

expect(pendingAfterAdmin).toHaveLength(1);

expect(pendingAfterAdmin[0]?.scopes ?? []).toEqual(expect.arrayContaining(["operator.admin"]));

expect(await getPairedDevice(identity.deviceId)).toBeTruthy();

if (!(await getPairedDevice(identity.deviceId))) {

throw new Error(`expected paired device ${identity.deviceId}`);

}

ws2.close();

await server.close();

restoreGatewayToken(prevToken);

const issuedOperatorToken = initialPayload?.auth?.deviceTokens?.find(

(entry) => entry.role === "operator",

)?.deviceToken;

expect(issuedDeviceToken).toBeDefined();

expect(issuedOperatorToken).toBeDefined();

if (!issuedDeviceToken || !issuedOperatorToken) {

throw new Error("expected issued device and operator tokens");

}

expect(initialPayload?.auth?.role).toBe("node");

expect(initialPayload?.auth?.scopes ?? []).toEqual([]);

expect(initialPayload?.auth?.deviceTokens?.some((entry) => entry.role === "node")).toBe(

const pendingUpgrade = (await listDevicePairing()).pending.find(

(entry) => entry.deviceId === identity.deviceId,

);

expect(pendingUpgrade).toBeTruthy();

if (!pendingUpgrade) {

throw new Error(`expected pending upgrade for device ${identity.deviceId}`);

}

expect(pendingUpgrade?.scopes ?? []).toEqual(expect.arrayContaining(["operator.admin"]));

const repaired = await getPairedDevice(identity.deviceId);

expect(repaired?.role).toBe("operator");

expect(dockerCli.ok).toBe(true);

const pending = await listDevicePairing();

expect(pending.pending.filter((entry) => entry.deviceId === identity.deviceId)).toEqual([]);

expect(await getPairedDevice(identity.deviceId)).toBeTruthy();

if (!(await getPairedDevice(identity.deviceId))) {

throw new Error(`expected paired device ${identity.deviceId}`);

}

} finally {

wsDockerCli.close();

await server.close();