From 7af4a68ef59dcae1911ad1ec6baba0b958e00d7a Mon Sep 17 00:00:00 2001 From: Yaojia Wang Date: Mon, 6 Jul 2026 21:50:08 +0200 Subject: [PATCH] fix(control-plane): encode enroll hostContentSecret as base64url (agent decodes base64url) --- control-plane/src/api/provision.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/control-plane/src/api/provision.ts b/control-plane/src/api/provision.ts index 2827c51..8ed040b 100644 --- a/control-plane/src/api/provision.ts +++ b/control-plane/src/api/provision.ts @@ -129,7 +129,8 @@ export function buildRouter(deps: ProvisionDeps): FastifyPluginAsync { agentPubkey: new Uint8Array(Buffer.from(body.agentPubkey, 'base64')), csr: decodeCsrWire(body.csr), }) - await reply.code(201).send({ ...result, hostContentSecret: Buffer.from(result.hostContentSecret).toString('base64') }) + // base64URL (not base64) — the agent decodes this via decodeBase64UrlBytes (enroll/pair.ts). + await reply.code(201).send({ ...result, hostContentSecret: Buffer.from(result.hostContentSecret).toString('base64url') }) } catch (err) { sendError(reply, err) }