fix: validate QR and action metadata edges

device_test.go

@@ -11,6 +11,7 @@ import (
 	"net/http/httptest"
 	"os"
 	"path/filepath"
+	"reflect"
 	"strings"
 	"sync"
 	"testing"
@@ -267,6 +268,36 @@ func TestInvalidDeviceInfoCacheRefreshesAndOverwrites(t *testing.T) {
 	}
 }
 
+func TestDecodeDeviceInfoRejectsNonexistentActionInput(t *testing.T) {
+	const cache = `{
+  "model":"test.light.v1",
+  "properties":[{"name":"power","description":"Power","type":"bool","rw":"rw","siid":2,"piid":1}],
+  "actions":[{"name":"toggle","siid":2,"aiid":1,"inputs":[{"name":"missing","type":"bool","rw":"rw","siid":2,"piid":99}]}]
+}`
+	_, err := decodeDeviceInfo([]byte(cache), "test.light.v1")
+	if err == nil || !strings.Contains(err.Error(), "does not reference a property") {
+		t.Fatalf("decodeDeviceInfo() error = %v, want missing property error", err)
+	}
+}
+
+func TestDecodeDeviceInfoCanonicalizesActionInputMetadata(t *testing.T) {
+	const cache = `{
+  "model":"test.light.v1",
+  "properties":[{"name":"power","description":"Power","type":"bool","rw":"rw","value-list":[{"value":0,"description":"Off"},{"value":1,"description":"On"}],"siid":2,"piid":1}],
+  "actions":[{"name":"toggle","siid":2,"aiid":1,"inputs":[{"name":"forged","description":"Forged","type":"string","rw":"w","range":[1,9,1],"siid":2,"piid":1}]}]
+}`
+	info, err := decodeDeviceInfo([]byte(cache), "test.light.v1")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(info.Actions) != 1 || len(info.Actions[0].Inputs) != 1 {
+		t.Fatalf("actions = %#v", info.Actions)
+	}
+	if got, want := info.Actions[0].Inputs[0], info.Properties[0]; !reflect.DeepEqual(got, want) {
+		t.Fatalf("canonical input = %#v, want %#v", got, want)
+	}
+}
+
 func TestInvalidDeviceInfoCacheRefreshFailureIncludesBothErrors(t *testing.T) {
 	testServer := newDeviceTestServer(t, []byte("unavailable"), nil)
 	testServer.status = http.StatusServiceUnavailable