# pawletcache-dev-registry

Throwaway local stand-in for the `oxmc.me` `/apis/aosp/cache/register` and
`/apis/aosp/cache/lookup` endpoints documented in `../README.md`. Exists so
`pawletcache-server` (and, separately, the Android `CentralLookupClient`) can
be exercised end-to-end without touching real `oxmc.me` infra or its actual
signing key.

**Not production code.** Two shortcuts that would be wrong on the real
`oxmc.me`:
- `lookup()` hands back whichever server registered most recently, full
  stop — no public-IP/NAT matching, because on localhost there's no NAT to
  match. The real registry has to match the *caller's* public IP against a
  registered server's public IP (see main README's Apple-content-caching
  comparison).
- Zero persistence hardening — `data/registrations.json` is a flat JSON
  file, fine for a laptop, not for anything real.

Everything about the actual wire protocol (request/response shape, what's
signed, the CacheToken format) is the real thing, though — this is a
faithful implementation of the spec, just with a self-issued root key and a
dumb `lookup()`.

## Running

```bash
cd dev-registry
DEV_ENROLLMENT_TOKENS=dev-local-token node src/index.js
```

First run generates a root Ed25519 keypair under `data/identity/` and prints
its public half — paste that into
`android_packages_apps_PawletCache/src/os/pawlet/cache/Constants.kt`'s
`CACHE_TRUST_ROOT_PUBKEY_BASE64` if you want a real device/emulator to trust
tokens this registry issues.

Env vars:
| Var | Default | |
|---|---|---|
| `DEV_REGISTRY_PORT` | `4000` | |
| `DEV_REGISTRY_DATA_DIR` | `./data` | |
| `DEV_ENROLLMENT_TOKENS` | `dev-local-token` | comma-separated allowlist |
| `DEV_TOKEN_TTL_MS` | `600000` (10 min) | short by default so you can actually see `pawletcache-server`'s renewal loop fire during a normal test session |

## Pointing pawletcache-server at it

In `../config.yml`:
```yaml
centralUrl: http://localhost:4000
enrollmentToken: dev-local-token
```
(Plain `http://` — this dev registry doesn't bother with TLS; the real
`oxmc.me` obviously would. `pawletcache-server`'s own asset-serving HTTPS
endpoint is unaffected either way, that's a separate TLS cert.)

## See also

`../scripts/smoke-test.sh` — drives this registry + `pawletcache-server`
together and checks the whole register → token → cache flow with curl.