@openmdm/core 0.6.0 → 0.7.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openmdm/core",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Core MDM SDK - device management, policies, and commands",
   "author": "OpenMDM Contributors",
   "type": "module",
@@ -33,7 +33,8 @@
     "tsup": "^8.0.0",
     "typescript": "^5.5.0",
     "vitest": "^2.0.0",
-    "@vitest/coverage-v8": "^2.0.0"
+    "@vitest/coverage-v8": "^2.0.0",
+    "@openmdm/client": "0.2.1"
   },
   "peerDependencies": {},
   "keywords": [

package/src/index.ts

@@ -1328,7 +1328,7 @@ function createStubPushAdapter(): PushAdapter {
 // Utility Functions
 // ============================================
 
-function verifyEnrollmentSignature(
+export function verifyEnrollmentSignature(
   request: EnrollmentRequest,
   secret: string
 ): boolean {
@@ -1338,11 +1338,21 @@ function verifyEnrollmentSignature(
     return false;
   }
 
-  // Reconstruct the message that was signed
-  // Format: identifier:timestamp
-  const identifier =
-    data.macAddress || data.serialNumber || data.imei || data.androidId || '';
-  const message = `${identifier}:${data.timestamp}`;
+  // Reconstruct the message that was signed. This must stay in lockstep with
+  // @openmdm/client's generateEnrollmentSignature — any change here is a wire
+  // break and must land in both places. A contract test in core/tests guards
+  // the format and will fail on divergence.
+  const message = [
+    data.model,
+    data.manufacturer,
+    data.osVersion,
+    data.serialNumber || '',
+    data.imei || '',
+    data.macAddress || '',
+    data.androidId || '',
+    data.method,
+    data.timestamp,
+  ].join('|');
 
   const expectedSignature = createHmac('sha256', secret)
     .update(message)