feat(m9/T24b): move-data-connection UI dialog + action

src/ZB.MOM.WW.ScadaBridge.CentralUI/Components/Pages/Design/DataConnections.razor

@@ -42,6 +42,12 @@
 
     <ToastNotification @ref="_toast" />
 
+    <MoveDataConnectionDialog @bind-IsVisible="_showMoveDialog"
+                              ConnectionId="_moveConnectionId"
+                              ConnectionName="@_moveConnectionName"
+                              SiteOptions="MoveTargetSiteOptions()"
+                              OnMoved="OnConnectionMoved" />
+
     @if (_loading)
     {
         <LoadingSpinner IsLoading="true" />
@@ -124,6 +130,12 @@
                                         Edit
                                     </button>
                                 </li>
+                                <li>
+                                    <button class="dropdown-item"
+                                            @onclick="() => OpenMoveDialog(node.Connection!)">
+                                        Move to Site…
+                                    </button>
+                                </li>
                                 <li><hr class="dropdown-divider" /></li>
                                 <li>
                                     <button class="dropdown-item text-danger"
@@ -150,6 +162,10 @@
                             @onclick='() => NavigationManager.NavigateTo($"/design/connections/{node.Connection!.Id}/edit")'>
                         Edit
                     </button>
+                    <button class="dropdown-item"
+                            @onclick="() => OpenMoveDialog(node.Connection!)">
+                        Move to Site…
+                    </button>
                     <div class="dropdown-divider"></div>
                     <button class="dropdown-item text-danger"
                             @onclick="() => DeleteConnection(node.Connection!)">
@@ -409,6 +425,38 @@
         }
     }
 
+    // ── M9-T24b: Move connection to another site ──
+    // The dialog dispatches MoveDataConnectionCommand through the guard-running
+    // ManagementActor path (IDataConnectionMoveService) — NOT a direct repository
+    // write — so the server enforces the Designer gate and every move guard. The
+    // page only opens the dialog, supplies the candidate target sites (the current
+    // site excluded), and reloads the tree once the move succeeds.
+    private bool _showMoveDialog;
+    private int _moveConnectionId;
+    private int _moveConnectionSiteId;
+    private string _moveConnectionName = string.Empty;
+
+    private void OpenMoveDialog(DataConnection conn)
+    {
+        _moveConnectionId = conn.Id;
+        _moveConnectionSiteId = conn.SiteId;
+        _moveConnectionName = conn.Name;
+        _showMoveDialog = true;
+    }
+
+    // Candidate target sites for the move: every site EXCEPT the connection's
+    // current one. Sourced from the already-loaded tree roots (each root is a site).
+    private IEnumerable<(int Id, string Label)> MoveTargetSiteOptions() =>
+        _treeRoots
+            .Where(r => r.SiteId is int sid && sid != _moveConnectionSiteId)
+            .Select(r => (r.SiteId!.Value, r.Label));
+
+    private async Task OnConnectionMoved()
+    {
+        _toast.ShowSuccess($"Connection '{_moveConnectionName}' moved.");
+        await LoadDataAsync();
+    }
+
     // M9-T25: enum → Bootstrap badge class. Mirrors the Health dashboard's
     // GetConnectionHealthBadge (Components/Pages/Monitoring/Health.razor) so the
     // design page surfaces the same colour coding for the same status. Kept as a

src/ZB.MOM.WW.ScadaBridge.CentralUI/Components/Shared/MoveDataConnectionDialog.razor

@@ -0,0 +1,105 @@
+@using ZB.MOM.WW.ScadaBridge.CentralUI.Services
+@inject IDataConnectionMoveService MoveService
+
+@*
+    M9-T24b: Move a data connection to another site. The picker lists the candidate
+    target sites (the page excludes the connection's current site). On confirm the
+    dialog dispatches MoveDataConnectionCommand through IDataConnectionMoveService —
+    the guard-running ManagementActor path, NOT a direct repository write — so the
+    server's Designer gate and every move guard (target exists, no name collision, no
+    instance binding, no native-alarm-source name reference) run. A guard error is
+    shown inline and the dialog stays open; success closes the dialog and raises
+    OnMoved so the page reloads the tree. Mirrors the MoveFolderDialog idiom.
+*@
+@if (IsVisible)
+{
+    <div class="modal show d-block" tabindex="-1" style="background: rgba(0,0,0,0.4);">
+        <div class="modal-dialog">
+            <div class="modal-content">
+                <div class="modal-header">
+                    <h6 class="modal-title">Move '@ConnectionName' to site…</h6>
+                    <button type="button" class="btn-close" @onclick="Close" disabled="@_busy"></button>
+                </div>
+                <div class="modal-body">
+                    @if (SiteOptions.Any())
+                    {
+                        <select class="form-select form-select-sm" @bind="_targetSiteId">
+                            @foreach (var opt in SiteOptions)
+                            {
+                                <option value="@opt.Id">@opt.Label</option>
+                            }
+                        </select>
+                    }
+                    else
+                    {
+                        <div class="text-muted small">No other site is available to move this connection to.</div>
+                    }
+                    @if (!string.IsNullOrEmpty(_error))
+                    {
+                        <div class="text-danger small mt-2" data-test="move-connection-error">@_error</div>
+                    }
+                </div>
+                <div class="modal-footer">
+                    <button class="btn btn-outline-secondary btn-sm" @onclick="Close" disabled="@_busy">Cancel</button>
+                    <button class="btn btn-primary btn-sm" @onclick="Submit"
+                            disabled="@(_busy || !SiteOptions.Any())">Move</button>
+                </div>
+            </div>
+        </div>
+    </div>
+}
+
+@code {
+    [Parameter] public bool IsVisible { get; set; }
+    [Parameter] public EventCallback<bool> IsVisibleChanged { get; set; }
+    [Parameter] public int ConnectionId { get; set; }
+    [Parameter] public string ConnectionName { get; set; } = string.Empty;
+    [Parameter] public IEnumerable<(int Id, string Label)> SiteOptions { get; set; } = Array.Empty<(int, string)>();
+
+    /// <summary>Raised after a successful move so the page can reload the tree.</summary>
+    [Parameter] public EventCallback OnMoved { get; set; }
+
+    private bool _wasVisible;
+    private int? _targetSiteId;
+    private string? _error;
+    private bool _busy;
+
+    protected override void OnParametersSet()
+    {
+        // Reset internal state on transition from hidden -> visible: default the
+        // picker to the first candidate site and clear any prior error.
+        if (IsVisible && !_wasVisible)
+        {
+            _targetSiteId = SiteOptions.Select(o => (int?)o.Id).FirstOrDefault();
+            _error = null;
+            _busy = false;
+        }
+        _wasVisible = IsVisible;
+    }
+
+    private async Task Close()
+    {
+        await IsVisibleChanged.InvokeAsync(false);
+    }
+
+    private async Task Submit()
+    {
+        if (_targetSiteId is not int target || _busy) return;
+
+        _busy = true;
+        _error = null;
+        var result = await MoveService.MoveAsync(ConnectionId, target);
+        _busy = false;
+
+        if (result.Success)
+        {
+            await IsVisibleChanged.InvokeAsync(false);
+            await OnMoved.InvokeAsync();
+        }
+        else
+        {
+            // Surface the server guard error inline; keep the dialog open.
+            _error = result.Error ?? "Move failed.";
+        }
+    }
+}

src/ZB.MOM.WW.ScadaBridge.CentralUI/ServiceCollectionExtensions.cs

@@ -116,6 +116,14 @@ public static class ServiceCollectionExtensions
         // ICentralHealthAggregator — no new plumbing.
         services.AddScoped<IConnectionHealthQueryService, ConnectionHealthQueryService>();
 
+        // Move-data-connection (M9-T24b): dispatches MoveDataConnectionCommand to the
+        // central ManagementActor through the in-process ManagementActorHolder seam —
+        // the same Ask path the HTTP /management endpoint uses. The server stays the
+        // single enforcer of the Designer gate and every move guard (target exists, no
+        // name collision, no instance binding, no native-alarm-source name reference);
+        // the move dialog only SUBMITS the command and renders the returned outcome.
+        services.AddScoped<IDataConnectionMoveService, DataConnectionMoveService>();
+
         // Roslyn-backed C# analysis for the Monaco script editor.
         // Scoped because SharedScriptCatalog wraps a scoped service.
         services.AddMemoryCache(o => o.SizeLimit = 200);

src/ZB.MOM.WW.ScadaBridge.CentralUI/Services/DataConnectionMoveService.cs

@@ -0,0 +1,127 @@
+using System.Security.Claims;
+using Akka.Actor;
+using Microsoft.AspNetCore.Components.Authorization;
+using Microsoft.Extensions.Logging;
+using ZB.MOM.WW.ScadaBridge.Commons.Messages.Management;
+using ZB.MOM.WW.ScadaBridge.ManagementService;
+using ZB.MOM.WW.ScadaBridge.Security;
+
+namespace ZB.MOM.WW.ScadaBridge.CentralUI.Services;
+
+/// <summary>
+/// Default <see cref="IDataConnectionMoveService"/> implementation — a thin facade that
+/// dispatches the <see cref="MoveDataConnectionCommand"/> to the central
+/// <c>ManagementActor</c> through the in-process <see cref="ManagementActorHolder"/>
+/// (the same Ask seam the HTTP <c>/management</c> endpoint uses). The actor authorizes
+/// the command against the supplied <see cref="AuthenticatedUser"/> (Designer-gated) and
+/// runs every move guard server-side — the target site must exist, the target must not
+/// already own a same-named connection, no instance binding may reference the
+/// connection, and no name-based native-alarm-source reference may be orphaned. None of
+/// that is re-implemented here; a guard failure returns as a classified error.
+/// </summary>
+/// <remarks>
+/// Mirrors <see cref="SecuredWriteService"/>: the current Blazor principal is projected
+/// to an <see cref="AuthenticatedUser"/> so the server's role gate runs against the real
+/// identity, and the three management response shapes plus any transport fault collapse
+/// into a typed <see cref="DataConnectionMoveResult"/>.
+/// </remarks>
+public sealed class DataConnectionMoveService : IDataConnectionMoveService
+{
+    private static readonly TimeSpan AskTimeout = TimeSpan.FromSeconds(30);
+
+    private readonly ManagementActorHolder _holder;
+    private readonly AuthenticationStateProvider _auth;
+    private readonly ILogger<DataConnectionMoveService> _logger;
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="DataConnectionMoveService"/>.
+    /// </summary>
+    /// <param name="holder">Holder for the central <c>ManagementActor</c> reference.</param>
+    /// <param name="auth">Authentication state provider used to project the current principal.</param>
+    /// <param name="logger">Logger instance.</param>
+    public DataConnectionMoveService(
+        ManagementActorHolder holder,
+        AuthenticationStateProvider auth,
+        ILogger<DataConnectionMoveService> logger)
+    {
+        _holder = holder ?? throw new ArgumentNullException(nameof(holder));
+        _auth = auth ?? throw new ArgumentNullException(nameof(auth));
+        _logger = logger ?? throw new ArgumentNullException(nameof(logger));
+    }
+
+    /// <inheritdoc/>
+    public async Task<DataConnectionMoveResult> MoveAsync(
+        int connectionId, int targetSiteId, CancellationToken cancellationToken = default)
+    {
+        var response = await SendAsync(
+            new MoveDataConnectionCommand(connectionId, targetSiteId), cancellationToken);
+        return response switch
+        {
+            ManagementSuccess => DataConnectionMoveResult.Ok(),
+            ManagementUnauthorized unauthorized => DataConnectionMoveResult.Fail(unauthorized.Message),
+            ManagementError error => DataConnectionMoveResult.Fail(error.Error),
+            _ => DataConnectionMoveResult.Fail(DescribeFailure(response)),
+        };
+    }
+
+    /// <summary>
+    /// Wraps <paramref name="command"/> in a <see cref="ManagementEnvelope"/> for the
+    /// current principal and Asks the <c>ManagementActor</c>. Transport faults (timeout,
+    /// actor not yet started, cancellation→propagated) become a synthetic
+    /// <see cref="ManagementError"/> so callers handle one response shape.
+    /// </summary>
+    private async Task<object> SendAsync(object command, CancellationToken cancellationToken)
+    {
+        var actor = _holder.ActorRef;
+        if (actor is null)
+        {
+            return new ManagementError(
+                string.Empty, "Management service is not ready.", "SERVICE_UNAVAILABLE");
+        }
+
+        var user = await BuildAuthenticatedUserAsync();
+        var envelope = new ManagementEnvelope(user, command, Guid.NewGuid().ToString("N"));
+
+        try
+        {
+            return await actor.Ask<object>(envelope, AskTimeout, cancellationToken);
+        }
+        catch (OperationCanceledException)
+        {
+            // Caller-initiated cancel (e.g. circuit teardown) — propagate cleanly.
+            throw;
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "ManagementActor Ask failed for {Command}", command.GetType().Name);
+            return new ManagementError(string.Empty, ex.Message, "TRANSPORT_ERROR");
+        }
+    }
+
+    /// <summary>
+    /// Projects the current Blazor <see cref="ClaimsPrincipal"/> to the
+    /// <see cref="AuthenticatedUser"/> the actor authorizes against — username,
+    /// display name, role claims, and the permitted-site scope claims (mirrors the
+    /// claim set the HTTP endpoint constructs).
+    /// </summary>
+    private async Task<AuthenticatedUser> BuildAuthenticatedUserAsync()
+    {
+        var state = await _auth.GetAuthenticationStateAsync();
+        var principal = state.User;
+
+        var username = principal.FindFirst(JwtTokenService.UsernameClaimType)?.Value ?? "unknown";
+        var displayName = principal.FindFirst(JwtTokenService.DisplayNameClaimType)?.Value ?? username;
+        var roles = principal.FindAll(JwtTokenService.RoleClaimType).Select(c => c.Value).ToArray();
+        var permittedSiteIds = principal.FindAll(JwtTokenService.SiteIdClaimType).Select(c => c.Value).ToArray();
+
+        return new AuthenticatedUser(username, displayName, roles, permittedSiteIds);
+    }
+
+    /// <summary>Renders a fallback description for an unexpected/failure response.</summary>
+    private static string DescribeFailure(object response) => response switch
+    {
+        ManagementUnauthorized unauthorized => unauthorized.Message,
+        ManagementError error => error.Error,
+        _ => "Unexpected response from the management service.",
+    };
+}

src/ZB.MOM.WW.ScadaBridge.CentralUI/Services/IDataConnectionMoveService.cs

@@ -0,0 +1,55 @@
+namespace ZB.MOM.WW.ScadaBridge.CentralUI.Services;
+
+/// <summary>
+/// Outcome of a single move-data-connection command dispatch. Wraps either success
+/// or a human-readable guard error, so the move dialog can render an inline result
+/// rather than reasoning about transport exceptions or the three management response
+/// shapes.
+/// </summary>
+/// <param name="Success">Whether the move succeeded.</param>
+/// <param name="Error">A human-readable error message when <paramref name="Success"/> is <c>false</c>; otherwise <c>null</c>.</param>
+public record DataConnectionMoveResult(bool Success, string? Error)
+{
+    /// <summary>Creates a successful result.</summary>
+    /// <returns>A successful <see cref="DataConnectionMoveResult"/>.</returns>
+    public static DataConnectionMoveResult Ok() => new(true, null);
+
+    /// <summary>Creates a failed result carrying <paramref name="error"/>.</summary>
+    /// <param name="error">The human-readable failure (typically a server guard message).</param>
+    /// <returns>A failed <see cref="DataConnectionMoveResult"/>.</returns>
+    public static DataConnectionMoveResult Fail(string error) => new(false, error);
+}
+
+/// <summary>
+/// CentralUI facade over the move-data-connection management command (M9-T24b). It
+/// dispatches the strongly-typed <c>MoveDataConnectionCommand</c> to the central
+/// <c>ManagementActor</c> through the in-process <c>ManagementActorHolder</c> seam —
+/// the SAME Ask path the HTTP <c>/management</c> endpoint uses — so the server remains
+/// the single enforcer of the Designer role gate and every move guard (target site
+/// exists, no name collision at the target, no instance binding references it, no
+/// name-based native-alarm-source references). The UI re-implements none of that: a
+/// move is a command submitted to the server, and any guard failure comes back as a
+/// classified error.
+/// </summary>
+/// <remarks>
+/// The current Blazor principal is projected to an <c>AuthenticatedUser</c> so the
+/// server's role gate runs against the real identity. <c>ManagementUnauthorized</c> /
+/// <c>ManagementError</c> / transport faults collapse into a typed
+/// <see cref="DataConnectionMoveResult"/> so the caller renders an inline outcome
+/// rather than throwing. Mirrors <c>ISecuredWriteService</c>.
+/// </remarks>
+public interface IDataConnectionMoveService
+{
+    /// <summary>
+    /// Moves the connection identified by <paramref name="connectionId"/> to
+    /// <paramref name="targetSiteId"/> via the guard-running ManagementActor.
+    /// </summary>
+    /// <param name="connectionId">Primary key of the connection to move.</param>
+    /// <param name="targetSiteId">Primary key of the destination site.</param>
+    /// <param name="cancellationToken">Cancellation token.</param>
+    /// <returns>A task that resolves to a <see cref="DataConnectionMoveResult"/> — success, or a classified guard / transport failure.</returns>
+    Task<DataConnectionMoveResult> MoveAsync(
+        int connectionId,
+        int targetSiteId,
+        CancellationToken cancellationToken = default);
+}