dohertj2/ScadaBridge
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(security): enforce template locks on native alarm source overrides at flatten and management-command level

Browse Source 
Add IsLocked to ResolvedNativeAlarmSource; FlatteningService skips overrides on a
locked source (mirrors attribute/alarm lock rules); ManagementActor SetInstanceNativeAlarmSourceOverride
flattens the instance and rejects an override on a locked source (and rejects a
canonical name that does not resolve, preventing dangling overrides).

Claude-Session: https://claude.ai/code/session_01MtdgwpEeCUn6cUA5f1LMPj
This commit is contained in:
Joseph Doherty
2026-07-09 16:28:52 -04:00
parent ab6077708f
commit 57f7f65772
6 changed files with 109 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/requirements/Component-TemplateEngine.md
+1 -1
View File
@@ -143,7 +143,7 @@ The `FlatteningService` resolves native alarm sources alongside alarms, emitting
- **Inheritance**: resolution walks the chain base → derived; a derived-level source wins over the base unless the base level locked it.
- **Composition**: a composed module's sources are path-qualified to the canonical name `[ModuleInstanceName].[Name]`, subject to the same naming-collision checks as other members. Because `SourceReference` is a raw connection address (not an attribute path), composition performs **no attribute-reference rewriting** on it.
- **Instance overrides**: `InstanceNativeAlarmSourceOverride` applies its non-null fields (`ConnectionNameOverride`, `SourceReferenceOverride`, `ConditionFilterOverride`) over the inherited/composed result and sets `Source = Override`.
- **Instance overrides**: `InstanceNativeAlarmSourceOverride` applies its non-null fields (`ConnectionNameOverride`, `SourceReferenceOverride`, `ConditionFilterOverride`) over the inherited/composed result and sets `Source = Override`. The resolved `ResolvedNativeAlarmSource` carries an `IsLocked` flag; a **locked** source is left untouched by any instance override (the flattener skips it, exactly mirroring the locked-attribute and locked-alarm rules). The lock is enforced at two points: the `FlatteningService` ignores overrides on a locked source, and the `ManagementActor` `SetInstanceNativeAlarmSourceOverride` handler rejects the command outright (and also rejects an override whose canonical name does not resolve, preventing dangling overrides).
## Inheritance Resolve — Authoring View