fix(deploy): confirm telemetry device identity

app/web/lib/store.js

@@ -20,7 +20,11 @@ function _save(id) {
     const payload = JSON.stringify({
       id, createdAt: s.createdAt, lastAccess: s.lastAccess, status: s.status,
       data:        s.data        || null,
+      originalFlows: s.originalFlows || null,
       fortiConfig: s.fortiConfig || null,
+      telemetryContextId: s.telemetryContextId || null,
+      telemetryAssociation: s.telemetryAssociation || null,
+      fortiConfigContextId: s.fortiConfigContextId || null,
     });
     const tmp = _cachePath(id) + '.' + Date.now() + '.tmp';
     fs.writeFile(tmp, payload, 'utf8', (err) => {
@@ -53,7 +57,13 @@ function _loadAll() {
           lastAccess:  payload.lastAccess,
           status:      payload.status,
           data:        payload.data,
+          originalFlows: payload.originalFlows || null,
           fortiConfig: payload.fortiConfig,
+          telemetryContextId: payload.telemetryContextId || crypto.randomBytes(16).toString('hex'),
+          telemetryAssociation: payload.telemetryAssociation || null,
+          fortiConfigRawText: null,
+          fortiConfigContextId: payload.fortiConfigContextId || null,
+          pendingFortiConfig: null,
           error:       null,
           emitter:     new EventEmitter(),
           progress:    { lines: 0, linesPerSec: 0, eta: null },
@@ -77,16 +87,22 @@ function evictOldest() {
   if (oldestId) deleteSession(oldestId);
 }
 
-function createSession() {
+function createSession(options = {}) {
   evictOldest();
   const id = crypto.randomBytes(16).toString('hex');
   sessions.set(id, {
     id,
     createdAt:   Date.now(),
     lastAccess:  Date.now(),
+    telemetryContextId: options.telemetryContextId || crypto.randomBytes(16).toString('hex'),
     status:      'parsing',
     data:        null,
+    originalFlows: null,
     error:       null,
+    telemetryAssociation: null,
+    fortiConfigRawText: null,
+    fortiConfigContextId: null,
+    pendingFortiConfig: null,
     emitter:     new EventEmitter(),
     progress:    { lines: 0, linesPerSec: 0, eta: null },
   });
@@ -103,6 +119,7 @@ function setSessionData(id, data, options = {}) {
   const s = sessions.get(id);
   if (s) {
     s.data = data;
+    if (options.originalFlows) s.originalFlows = options.originalFlows;
     s.status = 'ready';
     s.lastAccess = Date.now();
     if (options.persist !== false) _save(id);
@@ -118,6 +135,46 @@ function setFortiConfig(id, fortiConfig) {
   if (s) { s.fortiConfig = fortiConfig; _save(id); }
 }
 
+function setTelemetryContextId(id, telemetryContextId) {
+  const s = sessions.get(id);
+  if (s && telemetryContextId) {
+    s.telemetryContextId = String(telemetryContextId);
+    _save(id);
+  }
+}
+
+function setTelemetryAssociation(id, telemetryAssociation) {
+  const s = sessions.get(id);
+  if (s) {
+    s.telemetryAssociation = telemetryAssociation || null;
+    _save(id);
+  }
+}
+
+function setPendingFortiConfig(id, pendingFortiConfig) {
+  const s = sessions.get(id);
+  if (s) {
+    s.pendingFortiConfig = pendingFortiConfig || null;
+    _save(id);
+  }
+}
+
+function setFortiConfigRawText(id, rawText) {
+  const s = sessions.get(id);
+  if (s) {
+    s.fortiConfigRawText = rawText || null;
+    _save(id);
+  }
+}
+
+function setFortiConfigContextId(id, configContextId) {
+  const s = sessions.get(id);
+  if (s) {
+    s.fortiConfigContextId = configContextId || null;
+    _save(id);
+  }
+}
+
 function setSessionError(id, error) {
   const s = sessions.get(id);
   if (s) { s.error = error; s.status = 'error'; }
@@ -155,7 +212,7 @@ setInterval(() => {
       try { fs.unlink(_cachePath(id), () => {}); } catch { /* ignore */ }
     }
   }
-}, PURGE_INTERVAL);
+}, PURGE_INTERVAL).unref();
 
 // ─── Load persisted sessions on startup ───────────────────────────────────────
 _loadAll();
@@ -177,6 +234,11 @@ module.exports = {
   getSession,
   setSessionData,
   setFortiConfig,
+  setTelemetryContextId,
+  setTelemetryAssociation,
+  setPendingFortiConfig,
+  setFortiConfigRawText,
+  setFortiConfigContextId,
   setSessionError,
   deleteSession,
   getSessionCachePath,

app/web/lib/telemetry-association.js

@@ -0,0 +1,176 @@
+'use strict';
+
+const {
+  collectTelemetryIdentity,
+  normalizeConfigIdentity,
+  validateConfigTelemetryConsistency,
+} = require('./config-consistency');
+
+const ASSOCIATION_MATCHED = 'matched';
+const ASSOCIATION_CONFIRMATION_REQUIRED = 'confirmation_required';
+const ASSOCIATION_SELECTION_REQUIRED = 'selection_required';
+const ASSOCIATION_CONTRADICTION = 'contradiction';
+const CONFIG_TELEMETRY_ASSOCIATION_REQUIRED = 'CONFIG_TELEMETRY_ASSOCIATION_REQUIRED';
+const CONFIG_TELEMETRY_DEVICE_SELECTION_REQUIRED = 'CONFIG_TELEMETRY_DEVICE_SELECTION_REQUIRED';
+const CONFIG_TELEMETRY_MISMATCH = 'CONFIG_TELEMETRY_MISMATCH';
+
+function createConfirmedTelemetryAssociation({
+  telemetryDeviceName,
+  configHostname,
+  telemetryContextId,
+  configContextId,
+  confirmedAt = new Date().toISOString(),
+}) {
+  return {
+    telemetryDeviceName,
+    configHostname,
+    telemetryContextId,
+    configContextId,
+    confirmedByUser: true,
+    confirmedAt,
+  };
+}
+
+function createSelectedTelemetryAssociation({
+  telemetryDeviceName,
+  configHostname,
+  telemetryContextId,
+  configContextId,
+}) {
+  return {
+    telemetryDeviceName,
+    configHostname,
+    telemetryContextId,
+    configContextId,
+    selectedByUser: true,
+    confirmedByUser: false,
+    confirmedAt: null,
+  };
+}
+
+function isTelemetryAssociationUsable(association, context = {}) {
+  return Boolean(
+    (association?.confirmedByUser || association?.selectedByUser)
+      && association.telemetryDeviceName
+      && (association.confirmedByUser ? association.configHostname : true)
+      && association.telemetryContextId === context.telemetryContextId
+      && association.configContextId === context.configContextId
+      && (context.telemetryDeviceName === undefined || association.telemetryDeviceName === context.telemetryDeviceName)
+      && (context.configHostname === undefined || association.configHostname === context.configHostname),
+  );
+}
+
+function refuseTelemetryConfigAssociation() {
+  return {
+    status: 'unassociated',
+    code: 'CONFIG_TELEMETRY_ASSOCIATION_REFUSED',
+    association: null,
+  };
+}
+
+function evaluateTelemetryConfigAssociation(flows, fortiConfig = {}, context = {}, existingAssociation = null) {
+  const telemetryIdentity = collectTelemetryIdentity(flows);
+  const configIdentity = normalizeConfigIdentity(fortiConfig);
+  const telemetryDeviceNames = telemetryIdentity.devnames;
+  const selected = existingAssociation?.telemetryDeviceName || context.telemetryDeviceName || null;
+  const telemetryDeviceName = selected || (telemetryDeviceNames.length === 1 ? telemetryDeviceNames[0] : null);
+  const scopedFlows = selected
+    ? (Array.isArray(flows) ? flows : []).filter(flow => {
+      const scope = flow?.scope && typeof flow.scope === 'object' ? flow.scope : {};
+      return String(flow?.devname || scope.devname || '').trim() === selected;
+    })
+    : flows;
+  const validation = validateConfigTelemetryConsistency(scopedFlows, fortiConfig);
+  const base = {
+    telemetryDeviceNames,
+    telemetryDeviceName,
+    configHostname: configIdentity.hostname,
+    telemetryContextId: context.telemetryContextId || null,
+    configContextId: context.configContextId || null,
+    validation,
+  };
+
+  if (telemetryDeviceNames.length > 1 && !selected) {
+    return {
+      ...base,
+      status: ASSOCIATION_SELECTION_REQUIRED,
+      code: CONFIG_TELEMETRY_DEVICE_SELECTION_REQUIRED,
+      requiresConfirmation: true,
+    };
+  }
+  if (selected && !telemetryDeviceNames.includes(selected)) {
+    return {
+      ...base,
+      status: ASSOCIATION_CONTRADICTION,
+      code: CONFIG_TELEMETRY_MISMATCH,
+      requiresConfirmation: false,
+    };
+  }
+  if (configIdentity.hostname && telemetryDeviceName && configIdentity.hostname !== telemetryDeviceName) {
+    const hostnameMismatch = `hostname config=${configIdentity.hostname}; télémétrie=${telemetryDeviceName}`;
+    const confirmationSuppliesOnlyMissingProof = 'aucune preuve positive d’identité ou de correspondance interface-réseau';
+    const confirmableNameMismatch = validation.errors.length > 0
+      && validation.errors.every(error => (error.details || []).every(detail =>
+        detail === hostnameMismatch || detail === confirmationSuppliesOnlyMissingProof
+      ));
+    if (validation.errors.length > 0 && !confirmableNameMismatch) {
+      return {
+        ...base,
+        status: ASSOCIATION_CONTRADICTION,
+        code: CONFIG_TELEMETRY_MISMATCH,
+        requiresConfirmation: false,
+      };
+    }
+    if (existingAssociation?.confirmedByUser
+        && isTelemetryAssociationUsable(existingAssociation, {
+          ...context,
+          telemetryDeviceName,
+          configHostname: configIdentity.hostname,
+        })) {
+      if (confirmableNameMismatch) base.validation = { ...validation, ok: true, errors: [], message: null };
+      return {
+        ...base,
+        status: ASSOCIATION_MATCHED,
+        requiresConfirmation: false,
+        confirmedByUser: true,
+      };
+    }
+    if (confirmableNameMismatch) {
+      base.validation = { ...validation, ok: true, errors: [], message: null };
+    }
+    return {
+      ...base,
+      status: ASSOCIATION_CONFIRMATION_REQUIRED,
+      code: CONFIG_TELEMETRY_ASSOCIATION_REQUIRED,
+      requiresConfirmation: true,
+    };
+  }
+  if (!validation.ok) {
+    return {
+      ...base,
+      status: ASSOCIATION_CONTRADICTION,
+      code: CONFIG_TELEMETRY_MISMATCH,
+      requiresConfirmation: false,
+    };
+  }
+  return {
+    ...base,
+    status: ASSOCIATION_MATCHED,
+    requiresConfirmation: false,
+  };
+}
+
+module.exports = {
+  ASSOCIATION_MATCHED,
+  ASSOCIATION_CONFIRMATION_REQUIRED,
+  ASSOCIATION_SELECTION_REQUIRED,
+  ASSOCIATION_CONTRADICTION,
+  CONFIG_TELEMETRY_ASSOCIATION_REQUIRED,
+  CONFIG_TELEMETRY_DEVICE_SELECTION_REQUIRED,
+  CONFIG_TELEMETRY_MISMATCH,
+  createConfirmedTelemetryAssociation,
+  createSelectedTelemetryAssociation,
+  isTelemetryAssociationUsable,
+  refuseTelemetryConfigAssociation,
+  evaluateTelemetryConfigAssociation,
+};