feat(cli): working audit verify-chain via the VerifyAuditChain management command (ScadaBridge#41)

verify-chain was a no-op stub that printed "not enabled" and exited 0 without contacting the server. It now sends VerifyAuditChain(Month) over POST /management and maps the verdict to the exit code: 0 intact or not chained, 3 broken (first break: partition, ChainSeq, EventId, kind), 1 error, 2 unauthorized. Table and JSON renderings. ManagementActor: new HandleVerifyAuditChain arm, gated on the OperationalAudit roles (Administrator, Viewer) and refusing a site-scoped caller because a month's chain spans every site; INVALID_ARGUMENT for a bad month, CHAIN_BUSY when the chain lock is held; long-running Ask timeout. Result enums serialise as names. Parity: RequiredRoleMatrixTests freezes the gate; ManagementSurfaceParityTests now probes `audit verify-chain` (the one audit leaf that is a management contract) instead of skipping the whole audit group. Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV
2026-11-09 16:28:54 -05:00
parent fd4be80913
commit 548bb9a725
9 changed files with 333 additions and 27 deletions
@@ -0,0 +1,104 @@
+using System.Text.Json;
+using Akka.Actor;
+using Akka.TestKit.Xunit2;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging.Abstractions;
+using NSubstitute;
+using ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Repositories;
+using ZB.MOM.WW.ScadaBridge.Commons.Messages.Management;
+using ZB.MOM.WW.ScadaBridge.Commons.Types.Audit;
+
+namespace ZB.MOM.WW.ScadaBridge.ManagementService.Tests;
+
+/// <summary>
+/// The <c>VerifyAuditChain</c> management command (ScadaBridge#41): role gate, month
+/// parsing, site-scope refusal, and the verification result reaching the wire with its
+/// enums as names.
+/// </summary>
+public class VerifyAuditChainCommandTests : TestKit
+{
+    private readonly IAuditLogHashChain _chain = Substitute.For<IAuditLogHashChain>();
+
+    private IActorRef CreateActor()
+    {
+        var services = new ServiceCollection().AddTestConfigurationTransaction();
+        services.AddScoped(_ => _chain);
+        return Sys.ActorOf(Props.Create(() => new ManagementActor(
+            services.BuildServiceProvider(), NullLogger<ManagementActor>.Instance)));
+    }
+
+    private static ManagementEnvelope Envelope(object command, string[] sites, params string[] roles) =>
+        new(new AuthenticatedUser("u", "U", roles, sites), command, Guid.NewGuid().ToString("N"));
+
+    /// <summary>A Viewer gets the verifier's result for the requested month, enums as names.</summary>
+    [Fact]
+    public void Viewer_GetsVerificationResult_ForTheRequestedMonth()
+    {
+        var brk = new AuditChainBreak("2026-05", 7, Guid.Parse("11111111-2222-3333-4444-555555555555"),
+            AuditChainBreakKind.HashMismatch, "edited");
+        _chain.VerifyMonthAsync(Arg.Any<DateTime>(), Arg.Any<CancellationToken>())
+            .Returns(new AuditChainVerificationResult("2026-05", AuditChainStatus.Broken, 6, 0, null, 43, 2, brk));
+
+        CreateActor().Tell(Envelope(new VerifyAuditChainCommand("2026-05"), [], "Viewer"));
+
+        var response = ExpectMsg<ManagementSuccess>(TimeSpan.FromSeconds(5));
+        using var json = JsonDocument.Parse(response.JsonData);
+        Assert.Equal("Broken", json.RootElement.GetProperty("status").GetString());
+        Assert.Equal("HashMismatch", json.RootElement.GetProperty("firstBreak").GetProperty("kind").GetString());
+        Assert.Equal(7, json.RootElement.GetProperty("firstBreak").GetProperty("chainSeq").GetInt64());
+        _chain.Received(1).VerifyMonthAsync(
+            new DateTime(2026, 5, 1, 0, 0, 0, DateTimeKind.Utc), Arg.Any<CancellationToken>());
+    }
+
+    /// <summary>A Designer/Deployer without an OperationalAudit role is refused.</summary>
+    [Fact]
+    public void NonAuditRole_IsUnauthorized()
+    {
+        CreateActor().Tell(Envelope(new VerifyAuditChainCommand("2026-05"), [], "Designer", "Deployer"));
+
+        ExpectMsg<ManagementUnauthorized>(TimeSpan.FromSeconds(5));
+        _chain.DidNotReceiveWithAnyArgs().VerifyMonthAsync(default, default);
+    }
+
+    /// <summary>A site-scoped Viewer is refused: the chain spans every site.</summary>
+    [Fact]
+    public void SiteScopedViewer_IsRefused()
+    {
+        CreateActor().Tell(Envelope(new VerifyAuditChainCommand("2026-05"), ["3"], "Viewer"));
+
+        var response = ExpectMsg<ManagementUnauthorized>(TimeSpan.FromSeconds(5));
+        Assert.Contains("spans every site", response.Message);
+        _chain.DidNotReceiveWithAnyArgs().VerifyMonthAsync(default, default);
+    }
+
+    /// <summary>A malformed month is a caller error, not an internal fault.</summary>
+    [Fact]
+    public void MalformedMonth_IsInvalidArgument()
+    {
+        CreateActor().Tell(Envelope(new VerifyAuditChainCommand("2026-13"), [], "Administrator"));
+
+        var response = ExpectMsg<ManagementError>(TimeSpan.FromSeconds(5));
+        Assert.Equal("INVALID_ARGUMENT", response.ErrorCode);
+    }
+
+    /// <summary>A verification that cannot get the chain lock surfaces as CHAIN_BUSY.</summary>
+    [Fact]
+    public void BusyChain_IsChainBusy()
+    {
+        _chain.VerifyMonthAsync(Arg.Any<DateTime>(), Arg.Any<CancellationToken>())
+            .Returns<Task<AuditChainVerificationResult>>(_ => throw new TimeoutException("busy"));
+
+        CreateActor().Tell(Envelope(new VerifyAuditChainCommand("2026-05"), [], "Administrator"));
+
+        var response = ExpectMsg<ManagementError>(TimeSpan.FromSeconds(5));
+        Assert.Equal("CHAIN_BUSY", response.ErrorCode);
+    }
+
+    /// <summary>Verification runs under the long-running Ask timeout, not the 30 s default.</summary>
+    [Fact]
+    public void VerifyAuditChain_UsesLongRunningAskTimeout()
+    {
+        Assert.Equal(TimeSpan.FromMinutes(5),
+            ManagementEndpoints.ResolveAskTimeout(new ManagementServiceOptions(), typeof(VerifyAuditChainCommand)));
+    }
+}