RDKEMW-15146: Fix isSecureDbgSrvUnlocked for non-PROD builds; add PROD gating test coverage

[Copilot]

isSecureDbgSrvUnlocked was only unlocking eDEV builds unconditionally, leaving eVBN/eQA builds locked — a regression from the original eBuildType != ePROD semantics in GetServURL. Additionally, no tests existed for the new PROD gating logic (labsigned + deviceType RFC + dbgServices).

Logic fix

Changed the unconditional unlock condition from eBuildType == eDEV to eBuildType != ePROD, so all non-PROD builds (DEV, VBN, QA, etc.) bypass the RFC/labsigned checks:

// Before: only eDEV was always unlocked; VBN/QA fell through to return false
if (eBuildType == eDEV) { isDebugServicesUnlocked = true; }
else if (eBuildType == ePROD) { /* RFC + labsigned checks */ }

// After: all non-PROD builds are unconditionally unlocked
if (eBuildType != ePROD) { isDebugServicesUnlocked = true; }
else { /* RFC + labsigned checks for PROD only */ }

Test updates

• Removed stale isDebugServicesEnabled() mock expectations from VBN-based GetServURL tests — non-PROD builds no longer call it.
• Updated PROD+debug=true tests to supply getDeviceTypeRFC ("test") and getDevicePropertyData (labsigned="true") mocks, now required for PROD unlock.
• Added 4 new PROD-locked tests covering the full gating matrix:
  • dbgServices=false → locked
  • dbgServices=true + deviceType="prod" → locked
  • dbgServices=true + deviceType="test" + labsigned="false" → locked
  • dbgServices=true + deviceType="test" + getDevicePropertyData fails → locked

Docs

Updated device_api.h and function comment in device_api.c to accurately reflect that non-PROD builds are always unlocked, and that the DeviceType RFC comparison is lowercase "test".

---

💬 Send tasks to Copilot coding agent from Slack and Teams to turn conversations into code. Copilot posts an update in your thread when it's finished.