guard(di): captive-dependency tripwires — scope validation + an actor field scan
Register row 50. Row 45 (fixed 9e769735) was a live captive dependency —
NotificationOutboxActor cached delivery adapters resolved from an actor-lifetime
IServiceScope, so MaxParallelDeliveries concurrent deliveries shared one EF
DbContext and central-b logged EF's "second operation was started on this context
instance" continuously. Actors take the ROOT IServiceProvider rather than typed
services, which is invisible to build-time analysis, so the bug class had no
mechanical guard at all. This adds both of the register's mitigations; neither
subsumes the other.
1. ValidateScopes + ValidateOnBuild in Development, on BOTH branches, via
ServiceProviderValidation.Configure. WebApplication.CreateBuilder already sets
both flags to IsDevelopment(), so on paper this restates a default — it is
written out because that default is silent (a future move off CreateBuilder
drops it with no diagnostic) and because this host carries three
environment-ish signals (SCADABRIDGE_CONFIG, DOTNET_ENVIRONMENT,
ASPNETCORE_ENVIRONMENT), so "is this node in Development" is not obvious at the
call site. Production stays unvalidated deliberately: a validation failure is
fail-closed, and CI now proves what a production node will not check.
This surfaced two REAL latent violations on the SITE role — not captive
dependencies but unconstructible descriptors, which fail ValidateOnBuild for
the entire graph and are therefore what kept the site branch from being
validatable at all (SiteHealthEndpointTests had pinned UseEnvironment
("Production") to work around exactly this):
- ReconcileService (scoped, needs the central-only IDeploymentManagerRepository)
moved out of the shared AddCommunication() into a new AddCentralCommunication().
- AuditLogKpiSampleSource (scoped IKpiSampleSource, needs the central-only
IAuditLogRepository) moved out of the shared AddAuditLog() into a new
AddAuditLogCentralKpi().
Both were registered on sites under the argument "harmless — only the central
actor ever resolves it". True of the runtime, false of the container: a
registration nothing can build is what stops the validator being usable, and it
masks whatever real defect the validator would have found. Both are now
central-only and SiteHealthEndpointTests boots the site branch validated again.
2. CaptiveDependencyGuard: a reflection scan over every actor class in the shipped
assemblies (28 today; the reference graph is walked from the Host assembly
because referenced assemblies load lazily). Fails on any instance field — auto-
property backing fields included, they are ordinary private fields — typed as
IServiceScope, as a DbContext, or as a service the REAL composition roots
register Scoped. The scoped set is derived from the built Central and Site
containers rather than hand-listed, so a lifetime change automatically re-scopes
the check. IServiceProvider / IServiceScopeFactory fields are explicitly allowed:
that IS the correct per-operation-scope pattern.
No live violation exists — every actor opens a scope per operation. Two fields
are allowlisted with their safety argument rather than exempted silently:
AuditLogIngestActor._injectedRepository and SiteCallAuditActor._injectedRepository
are scoped repository types assigned ONLY by explicitly test-mode constructors,
null under production wiring (AkkaHostedService uses the IServiceProvider
overload in both cases), and SiteCallAuditActor additionally wraps its injected
instance in a SerializedRepository. The shape is one constructor call away from
being row 45 again, so it is recorded, not dismissed.
Tests: 10 new. Six permanent self-tests of the guard, including positive controls
that reproduce the pre-row-45 shape (an actor caching a scoped service, an
IServiceScope, a DbContext, and a scoped auto-property) and a negative control for
the allowed root-provider pattern — a reflection guard that matches nothing passes
just as green as one that works. Plus an actor-count floor with cross-assembly
spot-checks, an allowlist-staleness test that fails any entry no longer matching a
flagged field, and the two per-role scans. Verified non-vacuous by emptying the
allowlist: the Central scan then names both real fields. Two composition-root
build tests force both validation flags on per role regardless of environment.
Doc: REQ-HOST-11 in Component-Host.md records all three rules and their guards.
This commit is contained in:
Joseph Doherty
@@ -0,0 +1,287 @@
|
||||
using System.Reflection;
|
||||
using Akka.Actor;
|
||||
using Microsoft.EntityFrameworkCore;
|
||||
using Microsoft.Extensions.DependencyInjection;
|
||||
|
||||
namespace ZB.MOM.WW.ScadaBridge.Host.Tests;
|
||||
|
||||
/// <summary>
|
||||
/// Deferred register row 50, mitigation 2: a reflection guard that no Akka actor holds
|
||||
/// captive scope state — a scoped service, or an <see cref="IServiceScope"/>, cached for
|
||||
/// the actor's lifetime.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// <para>
|
||||
/// <b>Why this exists separately from scope validation.</b> Register row 45 was exactly this
|
||||
/// bug: <c>NotificationOutboxActor</c> cached delivery adapters resolved from an
|
||||
/// actor-lifetime <c>IServiceScope</c>, so <c>MaxParallelDeliveries</c> concurrent deliveries
|
||||
/// shared one EF <c>DbContext</c> and EF threw "a second operation was started on this
|
||||
/// context instance" continuously on the rig (fixed 9e769735). .NET's own
|
||||
/// <c>ValidateScopes</c> could never have caught it: the actors take the ROOT
|
||||
/// <see cref="IServiceProvider"/> and call <c>GetRequiredService</c> by hand, which the
|
||||
/// container's static graph analysis cannot see through. This guard closes that half.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// <b>What is allowed.</b> Holding <see cref="IServiceProvider"/> or
|
||||
/// <see cref="IServiceScopeFactory"/> for the actor's lifetime is the CORRECT pattern and is
|
||||
/// deliberately not flagged — every actor here does that and opens a fresh scope per
|
||||
/// operation. What is forbidden is holding the SCOPE, or anything resolved from one, past
|
||||
/// the operation that opened it.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// <b>How "scoped" is decided.</b> The caller supplies the scoped set derived from the actual
|
||||
/// DI registrations of a real composition root, so the guard tracks the container rather than
|
||||
/// a hand-maintained list — re-registering a service from singleton to scoped automatically
|
||||
/// brings any actor field of that type into scope for the check. Two types are flagged
|
||||
/// unconditionally on top of that set, because they are wrong in an actor field whatever the
|
||||
/// container says: <see cref="IServiceScope"/> itself, and any <see cref="DbContext"/>.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// Auto-property backing fields need no special handling: the compiler emits them as private
|
||||
/// instance fields, so <c>GetFields(NonPublic | Instance)</c> already returns them.
|
||||
/// </para>
|
||||
/// </remarks>
|
||||
internal static class CaptiveDependencyGuard
|
||||
{
|
||||
/// <summary>One offending field on one actor type.</summary>
|
||||
/// <param name="ActorType">The actor class declaring the field.</param>
|
||||
/// <param name="FieldName">The field's name (a compiler-generated backing field keeps its mangled name).</param>
|
||||
/// <param name="FieldType">The field's declared type.</param>
|
||||
/// <param name="Reason">Why the field was flagged.</param>
|
||||
internal sealed record Violation(Type ActorType, string FieldName, Type FieldType, string Reason)
|
||||
{
|
||||
/// <inheritdoc/>
|
||||
public override string ToString() =>
|
||||
$"{ActorType.FullName}.{FieldName} : {FieldType.FullName} — {Reason}";
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Field types that are always correct to hold for an actor's lifetime: they ARE the
|
||||
/// per-operation-scope pattern rather than a violation of it.
|
||||
/// </summary>
|
||||
internal static readonly IReadOnlyList<Type> AllowedProviderTypes =
|
||||
[
|
||||
typeof(IServiceProvider),
|
||||
typeof(IServiceScopeFactory),
|
||||
];
|
||||
|
||||
/// <summary>
|
||||
/// Fields that hold a scoped-typed value but are provably safe, keyed
|
||||
/// <c>"Namespace.ActorType.fieldName"</c>. Every entry carries its safety argument —
|
||||
/// nothing is exempted silently.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// <para>
|
||||
/// Both entries below are the same shape: a nullable repository field assigned ONLY by an
|
||||
/// explicitly test-mode constructor, so the production wiring
|
||||
/// (<c>AkkaHostedService</c> constructs both actors through their <see cref="IServiceProvider"/>
|
||||
/// overload) leaves the field null and every handler takes the create-a-scope branch. The
|
||||
/// test fixtures that do use those constructors are MSSQL-backed TestKit fixtures that
|
||||
/// drive the actor one message at a time, and <c>SiteCallAuditActor</c> additionally wraps
|
||||
/// the injected instance in its own <c>SerializedRepository</c> — i.e. the test path
|
||||
/// already carries a serialization guard for precisely the concurrency hazard row 45 hit.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// They are allowlisted rather than removed because deleting a test-mode constructor is a
|
||||
/// larger change than this row justifies, and rather than left unflagged because the shape
|
||||
/// is genuinely one constructor call away from being row 45 again: if a production call
|
||||
/// site ever switched to the repository overload, the actor would hold a scoped EF-backed
|
||||
/// repository for its whole lifetime. That residual risk is recorded, not dismissed.
|
||||
/// </para>
|
||||
/// </remarks>
|
||||
internal static readonly IReadOnlySet<string> Allowlist = new HashSet<string>(StringComparer.Ordinal)
|
||||
{
|
||||
"ZB.MOM.WW.ScadaBridge.AuditLog.Central.AuditLogIngestActor._injectedRepository",
|
||||
"ZB.MOM.WW.ScadaBridge.SiteCallAudit.SiteCallAuditActor._injectedRepository",
|
||||
};
|
||||
|
||||
/// <summary>
|
||||
/// Scans the given actor types for instance fields holding captive scope state.
|
||||
/// </summary>
|
||||
/// <param name="actorTypes">Actor classes to inspect.</param>
|
||||
/// <param name="scopedServiceTypes">
|
||||
/// Service and implementation types registered with <see cref="ServiceLifetime.Scoped"/>
|
||||
/// in the composition root being checked.
|
||||
/// </param>
|
||||
/// <param name="applyAllowlist">
|
||||
/// False makes the scan report allowlisted fields too — used by the guard's own self-tests
|
||||
/// so the allowlist cannot quietly grow to cover a real regression.
|
||||
/// </param>
|
||||
/// <returns>Every violation found, in declaration order.</returns>
|
||||
internal static IReadOnlyList<Violation> Scan(
|
||||
IEnumerable<Type> actorTypes,
|
||||
IReadOnlySet<Type> scopedServiceTypes,
|
||||
bool applyAllowlist = true)
|
||||
{
|
||||
ArgumentNullException.ThrowIfNull(actorTypes);
|
||||
ArgumentNullException.ThrowIfNull(scopedServiceTypes);
|
||||
|
||||
var violations = new List<Violation>();
|
||||
|
||||
foreach (var actorType in actorTypes)
|
||||
{
|
||||
foreach (var field in InstanceFields(actorType))
|
||||
{
|
||||
var fieldType = field.FieldType;
|
||||
|
||||
if (AllowedProviderTypes.Contains(fieldType))
|
||||
{
|
||||
// The correct pattern — create a scope per operation.
|
||||
continue;
|
||||
}
|
||||
|
||||
string? reason = null;
|
||||
if (fieldType == typeof(IServiceScope) || fieldType == typeof(AsyncServiceScope))
|
||||
{
|
||||
reason = "holds a DI scope for the actor's lifetime; open a scope per operation instead";
|
||||
}
|
||||
else if (typeof(DbContext).IsAssignableFrom(fieldType))
|
||||
{
|
||||
reason = "holds an EF DbContext for the actor's lifetime; resolve it inside a per-operation scope";
|
||||
}
|
||||
else if (scopedServiceTypes.Contains(fieldType))
|
||||
{
|
||||
reason = "holds a service registered Scoped; resolve it inside a per-operation scope";
|
||||
}
|
||||
|
||||
if (reason is null)
|
||||
{
|
||||
continue;
|
||||
}
|
||||
|
||||
if (applyAllowlist && Allowlist.Contains($"{actorType.FullName}.{field.Name}"))
|
||||
{
|
||||
continue;
|
||||
}
|
||||
|
||||
violations.Add(new Violation(actorType, field.Name, fieldType, reason));
|
||||
}
|
||||
}
|
||||
|
||||
return violations;
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Every instance field declared by the actor class and by its ScadaBridge-owned base
|
||||
/// classes. The walk stops at the first non-ScadaBridge base, which is how Akka's own
|
||||
/// <see cref="ActorBase"/> internals are excluded without naming them.
|
||||
/// </summary>
|
||||
/// <param name="actorType">The actor class to walk.</param>
|
||||
/// <returns>The instance fields, most-derived first.</returns>
|
||||
private static IEnumerable<FieldInfo> InstanceFields(Type actorType)
|
||||
{
|
||||
for (var t = actorType; t is not null && IsScadaBridgeType(t); t = t.BaseType)
|
||||
{
|
||||
foreach (var field in t.GetFields(
|
||||
BindingFlags.Instance | BindingFlags.Public | BindingFlags.NonPublic | BindingFlags.DeclaredOnly))
|
||||
{
|
||||
yield return field;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>Whether a type belongs to a first-party ScadaBridge assembly.</summary>
|
||||
/// <param name="type">The type to test.</param>
|
||||
/// <returns>True when the declaring assembly is a ScadaBridge assembly.</returns>
|
||||
private static bool IsScadaBridgeType(Type type) =>
|
||||
type.Assembly.GetName().Name?.StartsWith(AssemblyPrefix, StringComparison.Ordinal) == true;
|
||||
|
||||
private const string AssemblyPrefix = "ZB.MOM.WW.ScadaBridge";
|
||||
|
||||
/// <summary>
|
||||
/// Every concrete Akka actor class in the shipped ScadaBridge assemblies. Test assemblies
|
||||
/// are excluded deliberately — the guard's own deliberately-violating fixtures live there,
|
||||
/// and a test-only actor is not part of any production composition root.
|
||||
/// </summary>
|
||||
/// <returns>The production actor types, ordered by full name.</returns>
|
||||
internal static IReadOnlyList<Type> ProductionActorTypes() =>
|
||||
ProductionAssemblies()
|
||||
.SelectMany(a => a.GetTypes())
|
||||
.Where(t => typeof(ActorBase).IsAssignableFrom(t) && t is { IsAbstract: false, IsInterface: false })
|
||||
.OrderBy(t => t.FullName, StringComparer.Ordinal)
|
||||
.ToList();
|
||||
|
||||
/// <summary>
|
||||
/// Transitively loads and returns the shipped ScadaBridge assemblies.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// Referenced assemblies load lazily, so enumerating <c>AppDomain.CurrentDomain</c> alone
|
||||
/// would silently scan whichever subset the test run happened to touch — a guard that
|
||||
/// quietly checks nothing. The reference graph is walked from the Host assembly instead,
|
||||
/// and the caller asserts a floor on the actor count so a regression here fails loudly.
|
||||
/// </remarks>
|
||||
/// <returns>The distinct production ScadaBridge assemblies.</returns>
|
||||
private static IReadOnlyList<Assembly> ProductionAssemblies()
|
||||
{
|
||||
var seen = new Dictionary<string, Assembly>(StringComparer.Ordinal);
|
||||
var pending = new Stack<Assembly>();
|
||||
pending.Push(typeof(Program).Assembly);
|
||||
|
||||
while (pending.Count > 0)
|
||||
{
|
||||
var assembly = pending.Pop();
|
||||
var name = assembly.GetName().Name;
|
||||
if (name is null
|
||||
|| !name.StartsWith(AssemblyPrefix, StringComparison.Ordinal)
|
||||
|| name.EndsWith(".Tests", StringComparison.Ordinal)
|
||||
|| !seen.TryAdd(name, assembly))
|
||||
{
|
||||
continue;
|
||||
}
|
||||
|
||||
foreach (var reference in assembly.GetReferencedAssemblies())
|
||||
{
|
||||
if (reference.Name?.StartsWith(AssemblyPrefix, StringComparison.Ordinal) != true
|
||||
|| seen.ContainsKey(reference.Name))
|
||||
{
|
||||
continue;
|
||||
}
|
||||
|
||||
try
|
||||
{
|
||||
pending.Push(Assembly.Load(reference));
|
||||
}
|
||||
catch (Exception ex) when (ex is FileNotFoundException or BadImageFormatException)
|
||||
{
|
||||
// A ScadaBridge assembly that is referenced but not deployed alongside the
|
||||
// test binaries cannot contribute actors to this run either.
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return seen.Values.ToList();
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Collects the service and implementation types registered with
|
||||
/// <see cref="ServiceLifetime.Scoped"/> in a composition root.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// Both sides of a descriptor are collected: an actor can just as easily cache the
|
||||
/// concrete <c>EmailNotificationDeliveryAdapter</c> as the <c>INotificationDeliveryAdapter</c>
|
||||
/// it is registered as, and row 45 in fact cached the interface.
|
||||
/// </remarks>
|
||||
/// <param name="services">The composition root's service collection.</param>
|
||||
/// <returns>The scoped service and implementation types.</returns>
|
||||
internal static IReadOnlySet<Type> ScopedTypes(IEnumerable<ServiceDescriptor> services)
|
||||
{
|
||||
ArgumentNullException.ThrowIfNull(services);
|
||||
|
||||
var scoped = new HashSet<Type>();
|
||||
foreach (var descriptor in services.Where(d => d.Lifetime == ServiceLifetime.Scoped))
|
||||
{
|
||||
scoped.Add(descriptor.ServiceType);
|
||||
|
||||
// ImplementationType throws on a keyed descriptor and vice versa, so branch.
|
||||
var implementationType = descriptor.IsKeyedService
|
||||
? descriptor.KeyedImplementationType
|
||||
: descriptor.ImplementationType;
|
||||
if (implementationType is not null)
|
||||
{
|
||||
scoped.Add(implementationType);
|
||||
}
|
||||
}
|
||||
|
||||
return scoped;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,383 @@
|
||||
using Akka.Actor;
|
||||
using Microsoft.AspNetCore.Builder;
|
||||
using Microsoft.AspNetCore.Mvc.Testing;
|
||||
using Microsoft.EntityFrameworkCore;
|
||||
using Microsoft.Extensions.Configuration;
|
||||
using Microsoft.Extensions.DependencyInjection;
|
||||
using ZB.MOM.WW.ScadaBridge.ConfigurationDatabase;
|
||||
|
||||
namespace ZB.MOM.WW.ScadaBridge.Host.Tests;
|
||||
|
||||
/// <summary>
|
||||
/// The guard's own self-tests. These are what make the production scans below trustworthy:
|
||||
/// a reflection guard that silently matches nothing passes just as green as one that works,
|
||||
/// so the positive controls are permanent fixtures, not scaffolding.
|
||||
/// </summary>
|
||||
public class CaptiveDependencyGuardSelfTests
|
||||
{
|
||||
/// <summary>A stand-in for any service the container registers <c>Scoped</c>.</summary>
|
||||
private interface IPretendScopedService;
|
||||
|
||||
/// <summary>
|
||||
/// POSITIVE CONTROL — the pre-row-45 shape, preserved permanently. An actor that caches a
|
||||
/// scoped-typed service for its lifetime is exactly what <c>NotificationOutboxActor</c>
|
||||
/// looked like before 9e769735, and the guard must report it.
|
||||
/// </summary>
|
||||
private sealed class CachesScopedServiceActor : ReceiveActor
|
||||
{
|
||||
#pragma warning disable CS0169, IDE0051, CA1823 // the unused field IS the fixture
|
||||
private readonly IPretendScopedService? _captive;
|
||||
#pragma warning restore CS0169, IDE0051, CA1823
|
||||
}
|
||||
|
||||
/// <summary>POSITIVE CONTROL — caching the scope itself, the other half of row 45.</summary>
|
||||
private sealed class CachesScopeActor : ReceiveActor
|
||||
{
|
||||
#pragma warning disable CS0169, IDE0051, CA1823
|
||||
private readonly IServiceScope? _scope;
|
||||
#pragma warning restore CS0169, IDE0051, CA1823
|
||||
}
|
||||
|
||||
/// <summary>POSITIVE CONTROL — an EF context held for the actor's lifetime.</summary>
|
||||
private sealed class CachesDbContextActor : ReceiveActor
|
||||
{
|
||||
#pragma warning disable CS0169, IDE0051, CA1823
|
||||
private readonly ScadaBridgeDbContext? _db;
|
||||
#pragma warning restore CS0169, IDE0051, CA1823
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// NEGATIVE CONTROL — the correct pattern. Holding the root provider and/or the scope
|
||||
/// factory for the actor's lifetime must NOT be flagged; every production actor does this.
|
||||
/// </summary>
|
||||
private sealed class CreatesScopePerOperationActor : ReceiveActor
|
||||
{
|
||||
#pragma warning disable CS0169, IDE0051, CA1823
|
||||
private readonly IServiceProvider? _services;
|
||||
private readonly IServiceScopeFactory? _scopeFactory;
|
||||
#pragma warning restore CS0169, IDE0051, CA1823
|
||||
}
|
||||
|
||||
/// <summary>POSITIVE CONTROL — an auto-property backing field must be caught too.</summary>
|
||||
private sealed class ScopedAutoPropertyActor : ReceiveActor
|
||||
{
|
||||
private IPretendScopedService? Captive { get; init; }
|
||||
}
|
||||
|
||||
private static readonly IReadOnlySet<Type> PretendScopedSet =
|
||||
new HashSet<Type> { typeof(IPretendScopedService) };
|
||||
|
||||
[Fact]
|
||||
public void Guard_Flags_ActorCachingAScopedService()
|
||||
{
|
||||
var violations = CaptiveDependencyGuard.Scan(
|
||||
[typeof(CachesScopedServiceActor)], PretendScopedSet);
|
||||
|
||||
var violation = Assert.Single(violations);
|
||||
Assert.Equal("_captive", violation.FieldName);
|
||||
Assert.Equal(typeof(IPretendScopedService), violation.FieldType);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void Guard_Flags_ActorCachingAServiceScope_EvenWhenTheScopedSetIsEmpty()
|
||||
{
|
||||
// An IServiceScope field is wrong whatever the container says, so this must not
|
||||
// depend on the derived scoped set having caught anything.
|
||||
var violations = CaptiveDependencyGuard.Scan(
|
||||
[typeof(CachesScopeActor)], new HashSet<Type>());
|
||||
|
||||
var violation = Assert.Single(violations);
|
||||
Assert.Equal("_scope", violation.FieldName);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void Guard_Flags_ActorCachingADbContext()
|
||||
{
|
||||
var violations = CaptiveDependencyGuard.Scan(
|
||||
[typeof(CachesDbContextActor)], new HashSet<Type>());
|
||||
|
||||
var violation = Assert.Single(violations);
|
||||
Assert.Equal(typeof(ScadaBridgeDbContext), violation.FieldType);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void Guard_Flags_ScopedAutoPropertyBackingField()
|
||||
{
|
||||
var violations = CaptiveDependencyGuard.Scan(
|
||||
[typeof(ScopedAutoPropertyActor)], PretendScopedSet);
|
||||
|
||||
var violation = Assert.Single(violations);
|
||||
Assert.Contains("Captive", violation.FieldName, StringComparison.Ordinal);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void Guard_Allows_RootProviderAndScopeFactoryFields()
|
||||
{
|
||||
var violations = CaptiveDependencyGuard.Scan(
|
||||
[typeof(CreatesScopePerOperationActor)], PretendScopedSet);
|
||||
|
||||
Assert.Empty(violations);
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// The scoped set must be derived from real registrations rather than hand-listed, and it
|
||||
/// must pick up BOTH sides of a descriptor — row 45 cached the interface, but caching the
|
||||
/// concrete adapter would have been the same bug.
|
||||
/// </summary>
|
||||
[Fact]
|
||||
public void ScopedTypes_CollectsServiceAndImplementationTypes()
|
||||
{
|
||||
var services = new ServiceCollection();
|
||||
services.AddScoped<IPretendScopedService, PretendScopedService>();
|
||||
services.AddSingleton<PretendSingleton>();
|
||||
|
||||
var scoped = CaptiveDependencyGuard.ScopedTypes(services);
|
||||
|
||||
Assert.Contains(typeof(IPretendScopedService), scoped);
|
||||
Assert.Contains(typeof(PretendScopedService), scoped);
|
||||
Assert.DoesNotContain(typeof(PretendSingleton), scoped);
|
||||
}
|
||||
|
||||
private sealed class PretendScopedService : IPretendScopedService;
|
||||
|
||||
private sealed class PretendSingleton;
|
||||
|
||||
/// <summary>
|
||||
/// The assembly walk must actually find the production actors. Without this floor a
|
||||
/// broken loader would make every scan below vacuously green — the classic way a
|
||||
/// reflection guard rots into a no-op.
|
||||
/// </summary>
|
||||
[Fact]
|
||||
public void ProductionActorTypes_FindsTheShippedActors()
|
||||
{
|
||||
var actorTypes = CaptiveDependencyGuard.ProductionActorTypes();
|
||||
|
||||
// 28 actor classes ship today; the floor is deliberately loose so adding or
|
||||
// consolidating an actor does not fail this, while a loader that finds nothing does.
|
||||
Assert.True(
|
||||
actorTypes.Count >= 20,
|
||||
$"Expected the ScadaBridge assembly walk to find at least 20 actors, found {actorTypes.Count}. " +
|
||||
"A guard that scans no types passes vacuously.");
|
||||
|
||||
// Spot-check one actor from a site assembly and one from a central assembly, so a
|
||||
// walk that only reached the Host assembly's own actors cannot satisfy the floor.
|
||||
Assert.Contains(actorTypes, t => t.Name == "InstanceActor");
|
||||
Assert.Contains(actorTypes, t => t.Name == "NotificationOutboxActor");
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// The allowlist is an escape hatch, so it is itself pinned: every entry must name a
|
||||
/// field that still exists and would still be flagged. An entry that has stopped matching
|
||||
/// is either a stale exemption or — worse — a typo silently covering nothing.
|
||||
/// </summary>
|
||||
[Fact]
|
||||
public void Allowlist_EntriesAllStillMatchARealFlaggedField()
|
||||
{
|
||||
var actorTypes = CaptiveDependencyGuard.ProductionActorTypes();
|
||||
|
||||
// Scan with the allowlist disabled against a scoped set wide enough to include the
|
||||
// repositories the allowlisted fields hold.
|
||||
var everyScopedType = CaptiveDependencyGuard.ScopedTypes(BuildCentralishScopedProbe());
|
||||
var unfiltered = CaptiveDependencyGuard.Scan(actorTypes, everyScopedType, applyAllowlist: false);
|
||||
|
||||
var flagged = unfiltered
|
||||
.Select(v => $"{v.ActorType.FullName}.{v.FieldName}")
|
||||
.ToHashSet(StringComparer.Ordinal);
|
||||
|
||||
foreach (var entry in CaptiveDependencyGuard.Allowlist)
|
||||
{
|
||||
Assert.True(
|
||||
flagged.Contains(entry),
|
||||
$"Allowlist entry '{entry}' no longer matches a flagged field. Remove it — a stale " +
|
||||
"exemption is indistinguishable from an exemption that never worked.");
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// A minimal descriptor set naming the two repository types the allowlisted fields hold,
|
||||
/// so <see cref="Allowlist_EntriesAllStillMatchARealFlaggedField"/> does not need to boot a
|
||||
/// host. Both are registered <c>Scoped</c> by <c>AddConfigurationDatabase</c>; the
|
||||
/// role-scan tests below verify that against the real container.
|
||||
/// </summary>
|
||||
/// <returns>The probe descriptors.</returns>
|
||||
private static IServiceCollection BuildCentralishScopedProbe()
|
||||
{
|
||||
var services = new ServiceCollection();
|
||||
services.AddScoped<
|
||||
ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Repositories.IAuditLogRepository>(
|
||||
_ => throw new NotSupportedException("registration shape only"));
|
||||
services.AddScoped<
|
||||
ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Repositories.ISiteCallAuditRepository>(
|
||||
_ => throw new NotSupportedException("registration shape only"));
|
||||
return services;
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Runs the guard against every shipped actor using the CENTRAL composition root's real
|
||||
/// scoped registrations.
|
||||
/// </summary>
|
||||
[Collection(HostBootCollection.Name)]
|
||||
public class CentralCaptiveDependencyGuardTests : IDisposable
|
||||
{
|
||||
private readonly WebApplicationFactory<Program> _factory;
|
||||
private readonly string? _previousEnv;
|
||||
private readonly CentralDbTestEnvironment _dbEnv;
|
||||
private readonly List<ServiceDescriptor> _descriptors = [];
|
||||
|
||||
public CentralCaptiveDependencyGuardTests()
|
||||
{
|
||||
_previousEnv = Environment.GetEnvironmentVariable("DOTNET_ENVIRONMENT");
|
||||
Environment.SetEnvironmentVariable("DOTNET_ENVIRONMENT", "Central");
|
||||
_dbEnv = new CentralDbTestEnvironment();
|
||||
|
||||
_factory = new WebApplicationFactory<Program>()
|
||||
.WithWebHostBuilder(builder =>
|
||||
{
|
||||
builder.ConfigureAppConfiguration((_, config) =>
|
||||
{
|
||||
config.AddInMemoryCollection(new Dictionary<string, string?>
|
||||
{
|
||||
["ScadaBridge:Node:NodeName"] = "central-a",
|
||||
["ScadaBridge:Node:NodeHostname"] = "localhost",
|
||||
["ScadaBridge:Node:RemotingPort"] = "0",
|
||||
["ScadaBridge:Cluster:SeedNodes:0"] = "akka.tcp://scadabridge@localhost:2551",
|
||||
["ScadaBridge:Cluster:SeedNodes:1"] = "akka.tcp://scadabridge@localhost:2552",
|
||||
["ScadaBridge:Database:SkipMigrations"] = "true",
|
||||
["ScadaBridge:Security:JwtSigningKey"] = "test-signing-key-must-be-at-least-32-chars-long!",
|
||||
["ScadaBridge:Security:Ldap:Server"] = "localhost",
|
||||
["ScadaBridge:Security:Ldap:Port"] = "3893",
|
||||
["ScadaBridge:Security:Ldap:Transport"] = "None",
|
||||
["ScadaBridge:Security:Ldap:AllowInsecure"] = "true",
|
||||
["ScadaBridge:Security:Ldap:SearchBase"] = "dc=zb,dc=local",
|
||||
["ScadaBridge:Security:Ldap:ServiceAccountDn"] = "cn=admin,dc=zb,dc=local",
|
||||
["ScadaBridge:InboundApi:ApiKeyPepper"] = "test-inbound-api-key-pepper-at-least-32-chars!",
|
||||
});
|
||||
});
|
||||
builder.UseSetting("ScadaBridge:Node:Role", "Central");
|
||||
builder.UseSetting("ScadaBridge:Database:SkipMigrations", "true");
|
||||
builder.ConfigureServices(services =>
|
||||
{
|
||||
var descriptorsToRemove = services
|
||||
.Where(d =>
|
||||
d.ServiceType == typeof(DbContextOptions<ScadaBridgeDbContext>) ||
|
||||
d.ServiceType == typeof(DbContextOptions) ||
|
||||
d.ServiceType == typeof(ScadaBridgeDbContext) ||
|
||||
d.ServiceType.FullName?.Contains("EntityFrameworkCore") == true)
|
||||
.ToList();
|
||||
foreach (var d in descriptorsToRemove)
|
||||
services.Remove(d);
|
||||
|
||||
services.AddDbContext<ScadaBridgeDbContext>(options =>
|
||||
options.UseInMemoryDatabase($"CaptiveGuard_{Guid.NewGuid()}"));
|
||||
|
||||
AkkaHostedServiceRemover.RemoveAkkaHostedServiceOnly(services);
|
||||
|
||||
// ConfigureServices runs after Program.cs has added everything, so this
|
||||
// snapshot IS the Central composition root's registration set.
|
||||
_descriptors.AddRange(services);
|
||||
});
|
||||
});
|
||||
|
||||
_ = _factory.Server;
|
||||
}
|
||||
|
||||
public void Dispose()
|
||||
{
|
||||
try
|
||||
{
|
||||
_factory.Dispose();
|
||||
}
|
||||
finally
|
||||
{
|
||||
Environment.SetEnvironmentVariable("DOTNET_ENVIRONMENT", _previousEnv);
|
||||
_dbEnv.Dispose();
|
||||
}
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void Central_NoActorHoldsCaptiveScopedState()
|
||||
{
|
||||
var scopedTypes = CaptiveDependencyGuard.ScopedTypes(_descriptors);
|
||||
Assert.NotEmpty(scopedTypes);
|
||||
|
||||
var violations = CaptiveDependencyGuard.Scan(
|
||||
CaptiveDependencyGuard.ProductionActorTypes(), scopedTypes);
|
||||
|
||||
Assert.True(
|
||||
violations.Count == 0,
|
||||
"Actors holding captive scope state (register row 45's bug class):\n "
|
||||
+ string.Join("\n ", violations));
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// The same scan against the SITE composition root's real scoped registrations. Both roles
|
||||
/// are checked because the scoped set differs between them — a type that is a singleton on
|
||||
/// central can be scoped on a site, and only the role that registers it scoped can catch an
|
||||
/// actor caching it.
|
||||
/// </summary>
|
||||
public class SiteCaptiveDependencyGuardTests : IDisposable
|
||||
{
|
||||
private readonly string _tempDbPath;
|
||||
private readonly string _tempTrackingDbPath;
|
||||
private readonly string _tempLocalDbPath;
|
||||
private readonly string _tempAuditDbPath;
|
||||
private readonly IServiceCollection _services;
|
||||
|
||||
public SiteCaptiveDependencyGuardTests()
|
||||
{
|
||||
_tempDbPath = Path.Combine(Path.GetTempPath(), $"sb_guard_{Guid.NewGuid()}.db");
|
||||
_tempTrackingDbPath = Path.Combine(Path.GetTempPath(), $"sb_guard_track_{Guid.NewGuid()}.db");
|
||||
_tempLocalDbPath = Path.Combine(Path.GetTempPath(), $"sb_guard_localdb_{Guid.NewGuid()}.db");
|
||||
_tempAuditDbPath = Path.Combine(Path.GetTempPath(), $"sb_guard_audit_{Guid.NewGuid()}.db");
|
||||
|
||||
var builder = WebApplication.CreateBuilder();
|
||||
builder.Configuration.Sources.Clear();
|
||||
builder.Configuration.AddInMemoryCollection(new Dictionary<string, string?>
|
||||
{
|
||||
["ScadaBridge:Node:Role"] = "Site",
|
||||
["ScadaBridge:Node:NodeName"] = "node-a",
|
||||
["ScadaBridge:Node:NodeHostname"] = "test-site",
|
||||
["ScadaBridge:Node:SiteId"] = "TestSite",
|
||||
["ScadaBridge:Node:RemotingPort"] = "0",
|
||||
["ScadaBridge:Node:GrpcPort"] = "0",
|
||||
["ScadaBridge:Database:SiteDbPath"] = _tempDbPath,
|
||||
["ScadaBridge:OperationTracking:ConnectionString"] = $"Data Source={_tempTrackingDbPath}",
|
||||
["LocalDb:Path"] = _tempLocalDbPath,
|
||||
["AuditLog:SiteWriter:DatabasePath"] = _tempAuditDbPath,
|
||||
["ScadaBridge:Cluster:SeedNodes:0"] = "akka.tcp://scadabridge@localhost:2551",
|
||||
["ScadaBridge:Cluster:SeedNodes:1"] = "akka.tcp://scadabridge@localhost:2552",
|
||||
});
|
||||
|
||||
builder.Services.AddGrpc();
|
||||
SiteServiceRegistration.Configure(builder.Services, builder.Configuration);
|
||||
|
||||
// Registration only — the provider is never built here, so nothing resolves and no
|
||||
// site database file is opened.
|
||||
_services = builder.Services;
|
||||
}
|
||||
|
||||
public void Dispose()
|
||||
{
|
||||
foreach (var path in new[] { _tempDbPath, _tempTrackingDbPath, _tempLocalDbPath, _tempAuditDbPath })
|
||||
{
|
||||
try { File.Delete(path); } catch { /* best effort */ }
|
||||
}
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void Site_NoActorHoldsCaptiveScopedState()
|
||||
{
|
||||
var scopedTypes = CaptiveDependencyGuard.ScopedTypes(_services);
|
||||
Assert.NotEmpty(scopedTypes);
|
||||
|
||||
var violations = CaptiveDependencyGuard.Scan(
|
||||
CaptiveDependencyGuard.ProductionActorTypes(), scopedTypes);
|
||||
|
||||
Assert.True(
|
||||
violations.Count == 0,
|
||||
"Actors holding captive scope state (register row 45's bug class):\n "
|
||||
+ string.Join("\n ", violations));
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,232 @@
|
||||
using Microsoft.AspNetCore.Builder;
|
||||
using Microsoft.AspNetCore.Hosting;
|
||||
using Microsoft.AspNetCore.Mvc.Testing;
|
||||
using Microsoft.EntityFrameworkCore;
|
||||
using Microsoft.Extensions.Configuration;
|
||||
using Microsoft.Extensions.DependencyInjection;
|
||||
using Microsoft.Extensions.Hosting;
|
||||
using ZB.MOM.WW.ScadaBridge.ConfigurationDatabase;
|
||||
|
||||
namespace ZB.MOM.WW.ScadaBridge.Host.Tests;
|
||||
|
||||
/// <summary>
|
||||
/// Deferred register row 50, mitigation 1: .NET's built-in DI scope validation is on in
|
||||
/// Development for BOTH composition roots, and both roots actually survive it.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// The build-and-validate form is the load-bearing one. Asserting that
|
||||
/// <c>ValidateScopes</c> is set proves only that a flag was written; asserting that the
|
||||
/// full Central and Site graphs BUILD with <c>ValidateOnBuild</c> on is what proves there
|
||||
/// is no latent singleton-captures-scoped violation to be surfaced — and it keeps
|
||||
/// proving it as registrations are added, on every CI run, without anyone having to boot
|
||||
/// a node in Development.
|
||||
///
|
||||
/// Both roles force the flags on explicitly rather than relying on the environment, so
|
||||
/// the check runs identically in CI (where the environment is whatever the runner
|
||||
/// inherits) and so a future change to the environment plumbing cannot silently turn the
|
||||
/// coverage off — the exact failure mode this row is about.
|
||||
/// </remarks>
|
||||
public class ServiceProviderValidationOptionsTests
|
||||
{
|
||||
[Fact]
|
||||
public void Apply_InDevelopment_EnablesBothValidations()
|
||||
{
|
||||
var options = new ServiceProviderOptions();
|
||||
|
||||
ServiceProviderValidation.Apply(options, isDevelopment: true);
|
||||
|
||||
Assert.True(options.ValidateScopes);
|
||||
Assert.True(options.ValidateOnBuild);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void Apply_OutsideDevelopment_LeavesBothValidationsOff()
|
||||
{
|
||||
// Production pays neither the per-resolve scope check nor the boot-time graph
|
||||
// walk, and — more importantly — a validation failure cannot fail a production
|
||||
// node closed at boot. See ServiceProviderValidation's remarks.
|
||||
var options = new ServiceProviderOptions { ValidateScopes = true, ValidateOnBuild = true };
|
||||
|
||||
ServiceProviderValidation.Apply(options, isDevelopment: false);
|
||||
|
||||
Assert.False(options.ValidateScopes);
|
||||
Assert.False(options.ValidateOnBuild);
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Builds the REAL Central composition root (the whole <c>Program.cs</c> Central branch)
|
||||
/// with scope + build validation forced on, and asserts it builds clean.
|
||||
/// </summary>
|
||||
[Collection(HostBootCollection.Name)]
|
||||
public class CentralServiceProviderValidationTests : IDisposable
|
||||
{
|
||||
private readonly string? _previousEnv;
|
||||
private readonly CentralDbTestEnvironment _dbEnv;
|
||||
private WebApplicationFactory<Program>? _factory;
|
||||
|
||||
public CentralServiceProviderValidationTests()
|
||||
{
|
||||
_previousEnv = Environment.GetEnvironmentVariable("DOTNET_ENVIRONMENT");
|
||||
Environment.SetEnvironmentVariable("DOTNET_ENVIRONMENT", "Central");
|
||||
_dbEnv = new CentralDbTestEnvironment();
|
||||
}
|
||||
|
||||
public void Dispose()
|
||||
{
|
||||
try
|
||||
{
|
||||
_factory?.Dispose();
|
||||
}
|
||||
finally
|
||||
{
|
||||
Environment.SetEnvironmentVariable("DOTNET_ENVIRONMENT", _previousEnv);
|
||||
_dbEnv.Dispose();
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// A captive dependency anywhere in the Central graph — a singleton whose constructor
|
||||
/// takes a scoped service — makes <c>ValidateOnBuild</c> throw an
|
||||
/// <see cref="AggregateException"/> here listing every offender, so this test names
|
||||
/// the violation rather than leaving it to be found by a rig log line months later
|
||||
/// (which is how row 45 was found).
|
||||
/// </summary>
|
||||
[Fact]
|
||||
public void Central_CompositionRoot_BuildsWithScopeValidationEnabled()
|
||||
{
|
||||
_factory = new WebApplicationFactory<Program>()
|
||||
.WithWebHostBuilder(builder =>
|
||||
{
|
||||
// Force the flags on regardless of the runner's environment. This is the
|
||||
// same configuration Program.cs applies in Development, exercised here as
|
||||
// a hard assertion.
|
||||
builder.UseDefaultServiceProvider(options =>
|
||||
{
|
||||
options.ValidateScopes = true;
|
||||
options.ValidateOnBuild = true;
|
||||
});
|
||||
|
||||
builder.ConfigureAppConfiguration((_, config) =>
|
||||
{
|
||||
config.AddInMemoryCollection(new Dictionary<string, string?>
|
||||
{
|
||||
["ScadaBridge:Node:NodeName"] = "central-a",
|
||||
["ScadaBridge:Node:NodeHostname"] = "localhost",
|
||||
["ScadaBridge:Node:RemotingPort"] = "0",
|
||||
["ScadaBridge:Cluster:SeedNodes:0"] = "akka.tcp://scadabridge@localhost:2551",
|
||||
["ScadaBridge:Cluster:SeedNodes:1"] = "akka.tcp://scadabridge@localhost:2552",
|
||||
["ScadaBridge:Database:SkipMigrations"] = "true",
|
||||
["ScadaBridge:Security:JwtSigningKey"] = "test-signing-key-must-be-at-least-32-chars-long!",
|
||||
["ScadaBridge:Security:Ldap:Server"] = "localhost",
|
||||
["ScadaBridge:Security:Ldap:Port"] = "3893",
|
||||
["ScadaBridge:Security:Ldap:Transport"] = "None",
|
||||
["ScadaBridge:Security:Ldap:AllowInsecure"] = "true",
|
||||
["ScadaBridge:Security:Ldap:SearchBase"] = "dc=zb,dc=local",
|
||||
["ScadaBridge:Security:Ldap:ServiceAccountDn"] = "cn=admin,dc=zb,dc=local",
|
||||
["ScadaBridge:InboundApi:ApiKeyPepper"] = "test-inbound-api-key-pepper-at-least-32-chars!",
|
||||
});
|
||||
});
|
||||
builder.UseSetting("ScadaBridge:Node:Role", "Central");
|
||||
builder.UseSetting("ScadaBridge:Database:SkipMigrations", "true");
|
||||
builder.ConfigureServices(services =>
|
||||
{
|
||||
var descriptorsToRemove = services
|
||||
.Where(d =>
|
||||
d.ServiceType == typeof(DbContextOptions<ScadaBridgeDbContext>) ||
|
||||
d.ServiceType == typeof(DbContextOptions) ||
|
||||
d.ServiceType == typeof(ScadaBridgeDbContext) ||
|
||||
d.ServiceType.FullName?.Contains("EntityFrameworkCore") == true)
|
||||
.ToList();
|
||||
foreach (var d in descriptorsToRemove)
|
||||
services.Remove(d);
|
||||
|
||||
services.AddDbContext<ScadaBridgeDbContext>(options =>
|
||||
options.UseInMemoryDatabase($"ScopeValidation_{Guid.NewGuid()}"));
|
||||
|
||||
AkkaHostedServiceRemover.RemoveAkkaHostedServiceOnly(services);
|
||||
});
|
||||
});
|
||||
|
||||
// Building the server is the assertion: ValidateOnBuild throws from
|
||||
// BuildServiceProvider, and ValidateScopes throws on the first offending resolve.
|
||||
var services = _factory.Services;
|
||||
Assert.NotNull(services);
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// The Site half. This is the branch that actually gains coverage from the Program.cs
|
||||
/// change: the docker rig sets <c>ASPNETCORE_ENVIRONMENT=Development</c> on the central
|
||||
/// containers but not on the site containers, so a site node has always built its
|
||||
/// provider unvalidated.
|
||||
/// </summary>
|
||||
public class SiteServiceProviderValidationTests : IDisposable
|
||||
{
|
||||
private readonly string _tempDbPath;
|
||||
private readonly string _tempTrackingDbPath;
|
||||
private readonly string _tempLocalDbPath;
|
||||
private readonly string _tempAuditDbPath;
|
||||
private WebApplication? _host;
|
||||
|
||||
public SiteServiceProviderValidationTests()
|
||||
{
|
||||
_tempDbPath = Path.Combine(Path.GetTempPath(), $"sb_scopeval_{Guid.NewGuid()}.db");
|
||||
_tempTrackingDbPath = Path.Combine(Path.GetTempPath(), $"sb_scopeval_track_{Guid.NewGuid()}.db");
|
||||
_tempLocalDbPath = Path.Combine(Path.GetTempPath(), $"sb_scopeval_localdb_{Guid.NewGuid()}.db");
|
||||
_tempAuditDbPath = Path.Combine(Path.GetTempPath(), $"sb_scopeval_audit_{Guid.NewGuid()}.db");
|
||||
}
|
||||
|
||||
public void Dispose()
|
||||
{
|
||||
(_host as IDisposable)?.Dispose();
|
||||
foreach (var path in new[] { _tempDbPath, _tempTrackingDbPath, _tempLocalDbPath, _tempAuditDbPath })
|
||||
{
|
||||
try { File.Delete(path); } catch { /* best effort */ }
|
||||
}
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void Site_CompositionRoot_BuildsWithScopeValidationEnabled()
|
||||
{
|
||||
var builder = WebApplication.CreateBuilder();
|
||||
builder.Configuration.Sources.Clear();
|
||||
builder.Configuration.AddInMemoryCollection(new Dictionary<string, string?>
|
||||
{
|
||||
["ScadaBridge:Node:Role"] = "Site",
|
||||
["ScadaBridge:Node:NodeName"] = "node-a",
|
||||
["ScadaBridge:Node:NodeHostname"] = "test-site",
|
||||
["ScadaBridge:Node:SiteId"] = "TestSite",
|
||||
["ScadaBridge:Node:RemotingPort"] = "0",
|
||||
["ScadaBridge:Node:GrpcPort"] = "0",
|
||||
["ScadaBridge:Database:SiteDbPath"] = _tempDbPath,
|
||||
["ScadaBridge:OperationTracking:ConnectionString"] = $"Data Source={_tempTrackingDbPath}",
|
||||
["LocalDb:Path"] = _tempLocalDbPath,
|
||||
["AuditLog:SiteWriter:DatabasePath"] = _tempAuditDbPath,
|
||||
["ScadaBridge:Cluster:SeedNodes:0"] = "akka.tcp://scadabridge@localhost:2551",
|
||||
["ScadaBridge:Cluster:SeedNodes:1"] = "akka.tcp://scadabridge@localhost:2552",
|
||||
});
|
||||
|
||||
// The production Program.cs Site branch applies this via
|
||||
// ServiceProviderValidation.Configure; forced on here so the check does not depend
|
||||
// on the test runner's environment.
|
||||
builder.Host.UseDefaultServiceProvider(options =>
|
||||
{
|
||||
options.ValidateScopes = true;
|
||||
options.ValidateOnBuild = true;
|
||||
});
|
||||
|
||||
// Mirrors the Program.cs site section.
|
||||
builder.Services.AddGrpc();
|
||||
builder.Services.AddSingleton<ZB.MOM.WW.ScadaBridge.Communication.Grpc.SiteStreamGrpcServer>();
|
||||
builder.Services.AddSingleton<ZB.MOM.WW.ScadaBridge.Communication.Grpc.SiteCommandGrpcService>();
|
||||
|
||||
SiteServiceRegistration.Configure(builder.Services, builder.Configuration);
|
||||
AkkaHostedServiceRemover.RemoveAkkaHostedServiceOnly(builder.Services);
|
||||
|
||||
// Build is the assertion — ValidateOnBuild throws here if anything in the site
|
||||
// graph is a captive dependency.
|
||||
_host = builder.Build();
|
||||
Assert.NotNull(_host.Services);
|
||||
}
|
||||
}
|
||||
@@ -88,14 +88,14 @@ public class SiteHealthEndpointTests : IDisposable
|
||||
var factory = new WebApplicationFactory<Program>()
|
||||
.WithWebHostBuilder(builder =>
|
||||
{
|
||||
// WebApplicationFactory defaults the environment to Development, which turns on
|
||||
// ValidateOnBuild/ValidateScopes. The site graph carries scoped registrations whose
|
||||
// dependencies are central-only (ReconcileService → IDeploymentManagerRepository,
|
||||
// AuditLogKpiSampleSource → IAuditLogRepository) and are never resolved on a site
|
||||
// node, so eager validation fails on a composition that runs fine in production.
|
||||
// That is a pre-existing property of the site container, not of the health wiring
|
||||
// under test — run this fixture the way a site node actually runs.
|
||||
builder.UseEnvironment("Production");
|
||||
// The environment is left at WebApplicationFactory's Development default on
|
||||
// purpose, so this fixture boots the site branch with ValidateOnBuild/
|
||||
// ValidateScopes ON. It used to pin Production because the site graph carried two
|
||||
// central-only scoped registrations it could not construct (ReconcileService →
|
||||
// IDeploymentManagerRepository, AuditLogKpiSampleSource → IAuditLogRepository);
|
||||
// deferred register row 50 moved both to central-only extensions
|
||||
// (AddCentralCommunication / AddAuditLogCentralKpi), so the site container now
|
||||
// validates clean and there is no reason to run it unvalidated.
|
||||
|
||||
// ConfigureTestServices runs after the app's own registrations, so this drops the
|
||||
// hosted service that would form a real cluster while leaving the AkkaHostedService
|
||||
|
||||
Reference in New Issue
Block a user