fix(control-plane): encode enroll hostContentSecret as base64url (agent decodes base64url)

2026-07-06 21:50:08 +02:00
parent 6efed9772e
commit 7af4a68ef5
1 changed files with 2 additions and 1 deletions
--- a/control-plane/src/api/provision.ts
+++ b/control-plane/src/api/provision.ts
@@ -129,7 +129,8 @@ export function buildRouter(deps: ProvisionDeps): FastifyPluginAsync {
          agentPubkey: new Uint8Array(Buffer.from(body.agentPubkey, 'base64')),
          csr: decodeCsrWire(body.csr),
        })
-        await reply.code(201).send({ ...result, hostContentSecret: Buffer.from(result.hostContentSecret).toString('base64') })
+        // base64URL (not base64) — the agent decodes this via decodeBase64UrlBytes (enroll/pair.ts).
+        await reply.code(201).send({ ...result, hostContentSecret: Buffer.from(result.hostContentSecret).toString('base64url') })
      } catch (err) {
        sendError(reply, err)
      }