fix(device-pairing): align subset pairing with scope coverage

RomneyDa · RomneyDa · commit 5002769c4a56 · 2026-06-30T17:30:37.000-07:00
diff --git a/src/infra/device-pairing-churn.test.ts b/src/infra/device-pairing-churn.test.ts
@@ -167,6 +167,34 @@ describe("device pairing requestId churn", () => {
     expect(approved?.status).toBe("approved");
   });
 
+  test("keeps the requestId when operator.admin covers a pairing reconnect", async () => {
+    const baseDir = await makeDevicePairingDir();
+
+    const adminRequest = await requestDevicePairing(
+      {
+        deviceId: DEVICE_ID,
+        publicKey: PUBLIC_KEY,
+        role: "operator",
+        scopes: ["operator.admin"],
+      },
+      baseDir,
+    );
+
+    const pairingReconnect = await requestDevicePairing(
+      {
+        deviceId: DEVICE_ID,
+        publicKey: PUBLIC_KEY,
+        role: "operator",
+        scopes: ["operator.pairing"],
+      },
+      baseDir,
+    );
+
+    expect(pairingReconnect.created).toBe(false);
+    expect(pairingReconnect.request.requestId).toBe(adminRequest.request.requestId);
+    expect(pairingReconnect.request.scopes).toEqual(["operator.admin"]);
+  });
+
   test("supports cron-first progressive operator escalation from read to pairing to admin", async () => {
     const baseDir = await makeDevicePairingDir();
 
diff --git a/src/infra/device-pairing.ts b/src/infra/device-pairing.ts
@@ -374,10 +374,24 @@ function incomingApprovalCoveredByExisting(
   if (normalizeRole(existing.role) !== normalizeRole(incoming.role)) {
     return false;
   }
-  return (
-    isStringSubset(resolveRequestedRoles(incoming), resolveRequestedRoles(existing)) &&
-    isStringSubset(resolveRequestedScopes(incoming), resolveRequestedScopes(existing))
-  );
+  const incomingRoles = resolveRequestedRoles(incoming);
+  if (!isStringSubset(incomingRoles, resolveRequestedRoles(existing))) {
+    return false;
+  }
+  const existingScopes = resolveRequestedScopes(existing);
+  for (const scope of resolveRequestedScopes(incoming)) {
+    const covered = incomingRoles.some((role) =>
+      roleScopesAllow({
+        role,
+        requestedScopes: [scope],
+        allowedScopes: existingScopes,
+      }),
+    );
+    if (!covered) {
+      return false;
+    }
+  }
+  return true;
 }
 
 function refreshPendingDevicePairingRequest(
