chore: initial project import

backend/fleet/src/Fleet.Enrollment.Client/EnrollmentClient.cs

@@ -0,0 +1,82 @@
+using System.Security.Cryptography;
+using System.Text;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+using Fleet.Core;
+using Fleet.Hosting;
+using Fleet.Identity;
+
+namespace Fleet.Enrollment.Client;
+
+public sealed record EnrollmentResult(string NodeId, string Status, string IdentityDirectory);
+
+/// <summary>
+/// 用加入令牌注册（供 <c>fleet-enroll</c> 使用，也可以嵌入产品自己的安装工具）：
+/// 生成身份密钥和 TLS 证书 → 用身份私钥签名持有证明 → 调用注册端点 → 写入身份目录。
+/// 注册逻辑只存在于这里，常驻的业务进程不包含注册代码，也不使用 HttpClient。
+/// </summary>
+public static class EnrollmentClient
+{
+    public static async Task<Result<EnrollmentResult>> EnrollAsync(
+        HttpClient http, Uri server, string joinToken, string name, string identityDirectory, string nodeVersion, JsonNode? productMeta, TimeProvider time, CancellationToken ct)
+    {
+        string nodeFile = Path.Combine(identityDirectory, LoadedNodeIdentity.NodeFileName);
+        if (File.Exists(nodeFile))
+        {
+            return Result<EnrollmentResult>.Fail(FleetErrors.NameConflict, $"{nodeFile} already exists: this node is already enrolled (remove the directory to enroll again)");
+        }
+
+        using NodeIdentity identity = NodeIdentity.Generate();
+        byte[] pfx = NodeCertificate.CreateSelfSignedPfx(name, TimeSpan.FromDays(3650), time);
+        byte[] spki;
+        using (var certificate = NodeCertificate.LoadPfx(pfx))
+        {
+            spki = NodeCertificate.SpkiFingerprint(certificate);
+        }
+
+        string pubkey = Convert.ToBase64String(identity.PublicKeySpki);
+        string tokenHash = Convert.ToHexStringLower(SHA256.HashData(Encoding.UTF8.GetBytes(joinToken)));
+        var body = new JsonObject
+        {
+            ["join_token"] = joinToken,
+            ["name"] = name,
+            ["pubkey"] = pubkey,
+            ["tls_spki"] = Convert.ToBase64String(spki),
+            ["proof"] = Convert.ToBase64String(identity.Sign(SignaturePurpose.Enroll, tokenHash, pubkey)),
+            ["node_version"] = nodeVersion,
+            ["meta"] = productMeta,
+        };
+
+        using var content = new StringContent(body.ToJsonString(), Encoding.UTF8, "application/json");
+        using HttpResponseMessage response = await http.PostAsync(new Uri(server, "/api/agent/v1/enroll"), content, ct);
+        string text = await response.Content.ReadAsStringAsync(ct);
+        if (!response.IsSuccessStatusCode)
+        {
+            string code = "fleet_internal";
+            string detail = text;
+            try
+            {
+                JsonNode? problem = JsonNode.Parse(text);
+                code = problem?["code"]?.GetValue<string>() ?? code;
+                detail = problem?["detail"]?.GetValue<string>() ?? detail;
+            }
+            catch (JsonException)
+            {
+                // 不是 problem+json：原样返回
+            }
+
+            return Result<EnrollmentResult>.Fail(new ErrorCode(code), $"{(int)response.StatusCode}: {detail}");
+        }
+
+        JsonNode result = JsonNode.Parse(text)!;
+        string nodeId = result["node_id"]!.GetValue<string>();
+        var store = new ConfigStore(identityDirectory);
+        store.Write(LoadedNodeIdentity.KeyFileName, identity.ExportPkcs8());
+        store.Write(LoadedNodeIdentity.TlsFileName, pfx);
+        // node.json 最后写：它存在就表示注册完整完成
+        store.Write(
+            LoadedNodeIdentity.NodeFileName,
+            JsonSerializer.SerializeToUtf8Bytes(new NodeFile { NodeId = nodeId, Server = server.ToString().TrimEnd('/'), TlsSpki = Convert.ToBase64String(spki) }, NodeFileContext.Default.NodeFile));
+        return Result<EnrollmentResult>.Ok(new EnrollmentResult(nodeId, result["status"]!.GetValue<string>(), identityDirectory));
+    }
+}