Merge branch 'worktree-agent-abae452487b6dcad8' into fix/flow-debugger-arch-review

src/ZB.MOM.WW.ScadaBridge.ManagementService/FlowDebug/FlowDebugRunner.cs

@@ -38,6 +38,14 @@ public sealed class FlowDebugRunner
     /// <summary>Error code when the method / instance / site does not exist.</summary>
     public const string NotFoundCode = "NOT_FOUND";
 
+    /// <summary>
+    /// Arch-review F2: <see cref="InboundScriptExecutor"/>'s code for a routed call refused
+    /// because the target site is outside the operator's site scope. InboundAPI cannot
+    /// reference this assembly, so it raises its own <c>RouteSiteScopeException</c> and the
+    /// runner converts the code back to <see cref="SiteScopeViolationException"/>.
+    /// </summary>
+    public const string SiteScopeDeniedCode = "SITE_SCOPE_DENIED";
+
     /// <summary>The <c>Extra.source</c> value stamped on rows this runner synthesizes.</summary>
     public const string SourceTag = "flow-debugger";
 
@@ -103,7 +111,12 @@ public sealed class FlowDebugRunner
         var sw = Stopwatch.StartNew();
         var timeout = TimeSpan.FromSeconds(Math.Max(1, method.TimeoutSeconds));
 
-        var route = sp.GetRequiredService<RouteHelper>().WithTraceSink(events.Enqueue);
+        // Arch-review F2: a method Live run has no single target site to check up front the
+        // way RunValueChangeAsync does — the operator picks a METHOD, and where it routes is
+        // only known once the script runs. So the operator's scope is pushed into the
+        // RouteHelper and enforced at route time, before any site traffic.
+        var scope = await ResolvePermittedSiteIdentifiersAsync(sp, user, ct).ConfigureAwait(false);
+        var route = sp.GetRequiredService<RouteHelper>().WithTraceSink(events.Enqueue).WithSiteScope(scope);
         var executor = sp.GetRequiredService<InboundScriptExecutor>();
 
         InboundScriptResult result;
@@ -140,6 +153,16 @@ public sealed class FlowDebugRunner
             extra: new ScriptTraceExtra { Source = SourceTag }.ToJson());
         await WriteCentralAsync(sp, inboundRow, ct).ConfigureAwait(false);
 
+        // Arch-review F2: convert the executor's code into the same authorization failure
+        // RunValueChangeAsync raises, so both Live entry points surface one exception type
+        // (→ ManagementUnauthorized). Deliberately AFTER the inbound row is written: a
+        // denied attempt must still be audited against the operator's name.
+        if (string.Equals(result.ErrorCode, SiteScopeDeniedCode, StringComparison.Ordinal))
+        {
+            throw new SiteScopeViolationException(
+                result.ErrorMessage ?? "Access denied: routed call outside your site scope.");
+        }
+
         var ordered = new List<AuditEvent>(events.Count + 1) { inboundRow };
         ordered.AddRange(events.OrderBy(e => e.OccurredAtUtc).ThenBy(e => e.EventId));
 
@@ -301,6 +324,35 @@ public sealed class FlowDebugRunner
         }
     }
 
+    /// <summary>
+    /// Arch-review F2: the operator's <c>PermittedSiteIds</c> — NUMERIC site ids as strings —
+    /// resolved to the site IDENTIFIERS <see cref="IInstanceLocator"/> speaks, for
+    /// <c>RouteHelper.WithSiteScope</c>. Returns null (unscoped) for an unscoped user or an
+    /// Administrator, exactly as <see cref="EnforceSiteScope"/> treats them.
+    ///
+    /// <para>
+    /// A returned set may be EMPTY — a scoped user whose sites no longer exist routes nowhere.
+    /// That is the intended fail-closed outcome, and is why null and empty are not the same.
+    /// </para>
+    /// </summary>
+    private static async Task<IReadOnlySet<string>?> ResolvePermittedSiteIdentifiersAsync(
+        IServiceProvider sp, AuthenticatedUser user, CancellationToken ct)
+    {
+        if (user.PermittedSiteIds.Length == 0) return null;
+        if (user.Roles.Contains(Roles.Administrator, StringComparer.OrdinalIgnoreCase)) return null;
+
+        var sites = sp.GetRequiredService<ISiteRepository>();
+        var set = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+        foreach (var raw in user.PermittedSiteIds)
+        {
+            if (!int.TryParse(raw, out var id)) continue;
+            var site = await sites.GetSiteByIdAsync(id, ct).ConfigureAwait(false);
+            if (site is not null) set.Add(site.SiteIdentifier);
+        }
+
+        return set;
+    }
+
     private async Task WriteCentralAsync(IServiceProvider sp, AuditEvent evt, CancellationToken ct)
     {
         var writer = sp.GetService<ICentralAuditWriter>();