From 708389829bad0dac1a667e6ad7d16f5194326aaa Mon Sep 17 00:00:00 2001 From: Joseph Doherty Date: Sat, 15 Aug 2026 05:42:08 -0400 Subject: [PATCH] fix(transport): release abandoned BundleSessions instead of leaking a slot (row 43) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Only BundleImporter.ApplyAsync released an import session, so every path that opened one and did NOT apply held one of MaxConcurrentImportSessions (8) — and the DECRYPTED bundle content that T-007 deliberately zeroes on the apply paths — for the full BundleSessionTtlMinutes (30). Eight abandonments locked out all imports on the active node; observed live (R6: 3 back-to-back suite runs held 6 of 8 slots until central-b was restarted). New IBundleImporter.Abandon(sessionId): the same zero-then-remove release ApplyAsync performs, idempotent (double release / unknown id / expired id are no-ops) and only ever given the random-GUID id its caller opened, so it can never evict another circuit's session. Wired into every abandonment path: - Central UI wizard — ReleaseSession() from new upload, TryLoadAsync (before it overwrites _session), Back-to-Upload / ResetSessionState, the 3-strike lockout reset, and Dispose (navigation away / circuit teardown). - CLI transport preview — a preview never applies, so nothing released it at all; now released in a finally. - CLI transport import — covers the pre-apply aborts (blocker rows, unresolved site/connection mappings). Class doc's "an abandoned wizard does not leak" claim is true again (it only ever covered the staged plaintext temp file). Component-Transport.md + docs/components/Transport.md now record the explicit-release contract and that BundleSessionEvictionService is a TTL backstop, not an abandonment path. Tests: 4 bUnit tests over a REAL BundleSessionStore (dispose / back-to-upload / apply-then-dispose idempotency / concurrent-circuit isolation) — 3 of the 4 fail against the pre-fix page; 4 importer tests (release + zeroing, idempotency, cross-session isolation, and the slot-cap regression). --- docs/components/Transport.md | 10 +- docs/requirements/Component-Transport.md | 4 +- .../Pages/Design/TransportImport.razor.cs | 60 +++++- .../Interfaces/Transport/IBundleImporter.cs | 21 ++ .../ManagementActor.cs | 123 +++++++----- .../Import/BundleImporter.cs | 26 +++ .../Pages/Design/TransportImportPageTests.cs | 186 ++++++++++++++++++ .../Import/BundleImporterLoadTests.cs | 86 ++++++++ 8 files changed, 459 insertions(+), 57 deletions(-) diff --git a/docs/components/Transport.md b/docs/components/Transport.md index ff002939..cddd079c 100644 --- a/docs/components/Transport.md +++ b/docs/components/Transport.md @@ -39,7 +39,15 @@ When a passphrase is supplied, `BundleSecretEncryptor` derives a 256-bit key via ### BundleSession and session lifecycle -After `LoadAsync` validates and decrypts a bundle, the plaintext content is stored in a `BundleSession` held by the singleton `BundleSessionStore` (a `ConcurrentDictionary`). Sessions have a 30-minute TTL (`BundleSessionTtlMinutes`). `BundleSessionEvictionService` sweeps the store every minute so abandoned sessions — and the secrets they carry — are released without waiting for the next `Get` call. `ApplyAsync` explicitly zeros and removes the session on both success and failure (T-007). +After `LoadAsync` validates and decrypts a bundle, the plaintext content is stored in a `BundleSession` held by the singleton `BundleSessionStore` (a `ConcurrentDictionary`). Sessions have a 30-minute TTL (`BundleSessionTtlMinutes`). `BundleSessionEvictionService` sweeps the store every minute, but that only reclaims sessions whose TTL has already **elapsed** — it is a backstop, not an abandonment path. `ApplyAsync` explicitly zeros and removes the session on both success and failure (T-007). + +`IBundleImporter.Abandon(sessionId)` is the explicit release for a session that will never be applied, applying the same zero-then-remove ordering as `ApplyAsync`. It is idempotent (double release, unknown id, and already-expired id are all silent no-ops) and, because session ids are random GUIDs handed only to their opener, can never release another caller's session. Every abandonment path calls it: + +- Central UI wizard — new upload, Back-to-Upload / `ResetSessionState`, the 3-strike lockout reset, and `Dispose` (navigation away or circuit teardown). +- CLI `transport preview` — a preview never applies, so the handler releases in a `finally`. +- CLI `transport import` — covers the aborts that happen before `ApplyAsync` (blocker rows, unresolved site/connection mappings). + +Without this, an abandoned wizard or a plain CLI preview held one of the eight `MaxConcurrentImportSessions` slots — and the decrypted bundle content — for the full TTL; eight of them locked out every import on the active node (deferred register row 43, observed live). ### Conflict resolution and `BundleImportId` correlation diff --git a/docs/requirements/Component-Transport.md b/docs/requirements/Component-Transport.md index 5a67c215..2b150c16 100644 --- a/docs/requirements/Component-Transport.md +++ b/docs/requirements/Component-Transport.md @@ -112,7 +112,7 @@ The manifest is plaintext so the import wizard can preview bundle contents and s flowchart TD subgraph T["ZB.MOM.WW.ScadaBridge.Transport"] EXPORTER["IBundleExporter
ExportAsync(ExportSelection, Passphrase?, ct) → Stream"] - IMPORTER["IBundleImporter
LoadAsync(stream, Passphrase?, ct) → BundleSession
PreviewAsync(sessionId, ct) → ImportPreview
ApplyAsync(sessionId, resolutions, ct) → ImportResult"] + IMPORTER["IBundleImporter
LoadAsync(stream, Passphrase?, ct) → BundleSession
PreviewAsync(sessionId, ct) → ImportPreview
ApplyAsync(sessionId, resolutions, ct) → ImportResult
Abandon(sessionId)"] RESOLVER["DependencyResolver"] SERIALIZER["BundleSerializer
(manifest + content JSON; ZIP packer)"] ENCRYPTOR["BundleSecretEncryptor
(AES-256-GCM + PBKDF2)"] @@ -136,6 +136,8 @@ flowchart TD The component is central-hosted. It is registered in `ZB.MOM.WW.ScadaBridge.Host` for central roles only, never for site roles — even when a bundle carries site-scoped config (T18), Transport only writes the central configuration database, never the site clusters. All persistence flows through existing audited repository interfaces in `ZB.MOM.WW.ScadaBridge.ConfigurationDatabase` — the component does not call `DbContext.SaveChangesAsync` directly. `BundleSessionStore` is in-process on the active central node (matching Blazor Server circuit affinity): 30-minute TTL, eviction on expiry, 3-strike passphrase lockout per session, and a `MaxConcurrentImportSessions` cap (default 8; arch-review 05 Task 24 — startup-validated as `> 0` by `TransportOptionsValidator`, since a zero/negative cap would reject every import session forever) bounding the decrypted-content footprint since each open session pins a fully-decrypted bundle in memory. +**Session release is explicit, not TTL-only (register row 43).** `ApplyAsync` releases the session it applied (zero-then-remove, T-007), and `IBundleImporter.Abandon(sessionId)` does the same for a session that will never be applied. Every abandonment path calls it: the Central UI wizard on new upload / Back-to-Upload / `ResetSessionState` / lockout reset / `Dispose` (navigation away or circuit teardown), the CLI `transport preview` handler (a preview never applies), and the CLI `transport import` handler for the aborts that precede apply (blocker rows, unresolved mappings). `Abandon` is idempotent — double release, an unknown id, and an already-expired id are all silent no-ops — and since session ids are random GUIDs handed only to their opener, abandoning the id you hold can never evict another operator's in-progress import. Relying on the TTL alone was an availability *and* secret-lifetime defect: eight abandoned wizards exhausted `MaxConcurrentImportSessions` and locked out every import on the active node for 30 minutes, each still holding its decrypted bundle content. + **Preview→apply window (recorded decision).** The diff/preview an operator reviews is a point-in-time snapshot; there is **no optimistic concurrency** between preview and apply. If the target config changes in the window between `PreviewAsync` and `ApplyAsync` (another admin edits a template, say), the apply proceeds against the current state — the resolutions are keyed by `(EntityType, Name)`, so they still target the right rows, but the operator may not have seen the latest state in the diff. This is accepted for v1 (single-operator import is the expected workflow, and the terminal Confirm step already gates a typo-resistant environment-name entry). The bundle-format `version` fields are reserved for a future optimistic-concurrency check but are not yet enforced (Underdeveloped 5). ## Export Flow diff --git a/src/ZB.MOM.WW.ScadaBridge.CentralUI/Components/Pages/Design/TransportImport.razor.cs b/src/ZB.MOM.WW.ScadaBridge.CentralUI/Components/Pages/Design/TransportImport.razor.cs index 9461e76a..d7a5a2f6 100644 --- a/src/ZB.MOM.WW.ScadaBridge.CentralUI/Components/Pages/Design/TransportImport.razor.cs +++ b/src/ZB.MOM.WW.ScadaBridge.CentralUI/Components/Pages/Design/TransportImport.razor.cs @@ -51,6 +51,21 @@ namespace ZB.MOM.WW.ScadaBridge.CentralUI.Components.Pages.Design; /// retained on the component. The file is deleted on Back-to-Upload / Reset / /// successful Apply / component Dispose, so an abandoned wizard does not leak /// staged bundle plaintext beyond circuit teardown. +/// +/// +/// Server-side session release (register row 43): the staged temp file is only +/// half of an abandoned wizard's footprint — the server-side +/// opened by +/// holds the DECRYPTED bundle content and occupies one of +/// TransportOptions.MaxConcurrentImportSessions slots for the full +/// BundleSessionTtlMinutes. Only +/// used to release it, so eight abandoned wizards locked out every import on the +/// active node. Every path that drops _session — new upload, Back-to-Upload, +/// , lockout reset, circuit teardown via +/// — now goes through , which +/// calls (zero + remove, idempotent and +/// safe after a successful Apply has already released the same id). +/// /// public partial class TransportImport : ComponentBase, IDisposable { @@ -149,7 +164,9 @@ public partial class TransportImport : ComponentBase, IDisposable { _errorMessage = null; _uploadInProgress = true; - _session = null; + // Release the previous upload's server-side session before we lose the + // only reference to its id — otherwise re-selecting a file leaks a slot. + ReleaseSession(); DeleteBundleTempFile(); try { @@ -207,6 +224,10 @@ public partial class TransportImport : ComponentBase, IDisposable _errorMessage = "No bundle staged — please re-select the file."; return; } + // A successful LoadAsync overwrites _session; release whatever it is + // replacing first so the id of the outgoing session is never dropped on + // the floor (that would strand its slot for the full TTL). + ReleaseSession(); try { // Read the staged bundle straight off disk; the @@ -808,7 +829,7 @@ public partial class TransportImport : ComponentBase, IDisposable private void ResetSessionState() { - _session = null; + ReleaseSession(); DeleteBundleTempFile(); _preview = null; _resolutions = null; @@ -854,12 +875,41 @@ public partial class TransportImport : ComponentBase, IDisposable } /// - /// Ensures the staged temp file does not survive circuit - /// teardown. Blazor invokes Dispose when the user navigates away or the - /// circuit ends, so an abandoned wizard cleans up automatically. + /// Releases the server-side this wizard opened + /// (zeroing its decrypted content) and clears the local reference. Idempotent: + /// a null _session is a no-op, and + /// tolerates an id that already + /// released. Only ever passes the id THIS circuit opened, so a concurrent + /// operator's session is never touched. + /// + /// Abandon failure must not block the wizard (or, from , + /// tear down the circuit), so it is swallowed on the same best-effort footing + /// as the staged-file delete below. + /// + /// + private void ReleaseSession() + { + var session = _session; + _session = null; + if (session is null) return; + try + { + BundleImporter.Abandon(session.SessionId); + } + catch + { + // Best-effort: the session's own TTL is the backstop. + } + } + + /// + /// Ensures neither the staged temp file nor the server-side bundle session + /// survives circuit teardown. Blazor invokes Dispose when the user navigates + /// away or the circuit ends, so an abandoned wizard cleans up automatically. /// public void Dispose() { + ReleaseSession(); DeleteBundleTempFile(); } } diff --git a/src/ZB.MOM.WW.ScadaBridge.Commons/Interfaces/Transport/IBundleImporter.cs b/src/ZB.MOM.WW.ScadaBridge.Commons/Interfaces/Transport/IBundleImporter.cs index 9ad6a977..3990348d 100644 --- a/src/ZB.MOM.WW.ScadaBridge.Commons/Interfaces/Transport/IBundleImporter.cs +++ b/src/ZB.MOM.WW.ScadaBridge.Commons/Interfaces/Transport/IBundleImporter.cs @@ -46,4 +46,25 @@ public interface IBundleImporter string user, CancellationToken ct = default, BundleNameMap? nameMap = null); + + /// + /// Releases a session opened by that will never be + /// applied — the operator navigated away, restarted the wizard, or a CLI + /// preview/import gave up before ran. Zeroes the + /// session's decrypted plaintext and drops it from the session store, which + /// frees one of the MaxConcurrentImportSessions slots immediately + /// instead of at the end of BundleSessionTtlMinutes. + /// + /// Idempotent and safe to call after (which performs + /// the same release on both its success and failure paths) or with an unknown + /// / already-expired id — the call is then a no-op and never throws. + /// + /// + /// Ownership: session ids are random GUIDs handed only to the caller that + /// opened them, so abandoning the id you hold can never release a session + /// another circuit / CLI caller owns. + /// + /// + /// Session id returned by . + void Abandon(Guid sessionId); } diff --git a/src/ZB.MOM.WW.ScadaBridge.ManagementService/ManagementActor.cs b/src/ZB.MOM.WW.ScadaBridge.ManagementService/ManagementActor.cs index ab92e42e..5dfbaba0 100644 --- a/src/ZB.MOM.WW.ScadaBridge.ManagementService/ManagementActor.cs +++ b/src/ZB.MOM.WW.ScadaBridge.ManagementService/ManagementActor.cs @@ -3571,16 +3571,27 @@ public class ManagementActor : ReceiveActor throw new ManagementCommandException("Wrong passphrase or bundle was tampered."); } - var preview = await importer.PreviewAsync(session.SessionId); - var adds = preview.Items.Count(i => i.Kind == ConflictKind.New); - var mods = preview.Items.Count(i => i.Kind == ConflictKind.Modified); - var ids = preview.Items.Count(i => i.Kind == ConflictKind.Identical); - var blocks = preview.Items.Count(i => i.Kind == ConflictKind.Blocker); - // Surface the required site/connection mappings so an operator - // (CLI or UI) sees which references need resolving before applying. - return new PreviewBundleResult( - preview.Items, adds, mods, ids, blocks, - preview.RequiredSiteMappings, preview.RequiredConnectionMappings); + // Register row 43: a preview NEVER applies, so nothing else would ever + // release this session — every `transport preview` used to burn one of + // MaxConcurrentImportSessions (and hold the decrypted bundle) for the + // full BundleSessionTtlMinutes. Release it on the way out, always. + try + { + var preview = await importer.PreviewAsync(session.SessionId); + var adds = preview.Items.Count(i => i.Kind == ConflictKind.New); + var mods = preview.Items.Count(i => i.Kind == ConflictKind.Modified); + var ids = preview.Items.Count(i => i.Kind == ConflictKind.Identical); + var blocks = preview.Items.Count(i => i.Kind == ConflictKind.Blocker); + // Surface the required site/connection mappings so an operator + // (CLI or UI) sees which references need resolving before applying. + return new PreviewBundleResult( + preview.Items, adds, mods, ids, blocks, + preview.RequiredSiteMappings, preview.RequiredConnectionMappings); + } + finally + { + importer.Abandon(session.SessionId); + } } finally { @@ -3618,50 +3629,62 @@ public class ManagementActor : ReceiveActor throw new ManagementCommandException("Wrong passphrase or bundle was tampered."); } - var preview = await importer.PreviewAsync(session.SessionId); - - var blockers = preview.Items.Where(i => i.Kind == ConflictKind.Blocker).ToList(); - if (blockers.Count > 0) + // Register row 43: ApplyAsync releases the session on both its success + // and failure paths, but every abort BEFORE it (blockers, unresolved + // mappings) used to strand the session — and its decrypted content — + // for the full TTL. Abandon is idempotent, so covering the whole block + // is safe even when ApplyAsync already released the same id. + try { - var details = string.Join("; ", - blockers.Select(b => $"{b.Name}: {b.BlockerReason}")); - throw new ManagementCommandException( - $"Bundle has {blockers.Count} blocker(s); import aborted. {details}"); - } + var preview = await importer.PreviewAsync(session.SessionId); - // Resolve every required site/connection reference into a - // BundleNameMap. Precedence: an explicit operator spec wins; otherwise - // fall back to the preview's auto-match; otherwise (no match) create-new - // ONLY if the create-missing flag is set, else fail with a clear message. - var nameMap = BuildNameMap(cmd, preview); - - // Dedupe by (EntityType, Name) -- the preview can emit multiple rows per - // entity (e.g. one row per modified member of a template), but ApplyAsync - // requires a unique resolution per key. Last-write-wins matches the - // Central UI's TransportImport.BuildDefaultResolutions behavior. For - // DataConnection rows the preview item Name is already site-qualified - // ({site}/{name}), so keying generically by (EntityType, Name) is - // automatically correct — no bare-connection-name special case needed. - var renameStamp = DateTime.UtcNow.ToString("yyyyMMdd-HHmmss"); - var resolutionsMap = new Dictionary<(string, string), ImportResolution>(); - foreach (var item in preview.Items) - { - var action = item.Kind switch + var blockers = preview.Items.Where(i => i.Kind == ConflictKind.Blocker).ToList(); + if (blockers.Count > 0) { - ConflictKind.New => ResolutionAction.Add, - ConflictKind.Identical => ResolutionAction.Skip, - ConflictKind.Modified => policy, - _ => ResolutionAction.Skip, - }; - var renameTo = (item.Kind == ConflictKind.Modified && policy == ResolutionAction.Rename) - ? $"{item.Name}-imported-{renameStamp}" - : null; - resolutionsMap[(item.EntityType, item.Name)] = new ImportResolution( - item.EntityType, item.Name, action, renameTo); - } + var details = string.Join("; ", + blockers.Select(b => $"{b.Name}: {b.BlockerReason}")); + throw new ManagementCommandException( + $"Bundle has {blockers.Count} blocker(s); import aborted. {details}"); + } - return await importer.ApplyAsync( - session.SessionId, resolutionsMap.Values.ToList(), username, nameMap: nameMap); + // Resolve every required site/connection reference into a + // BundleNameMap. Precedence: an explicit operator spec wins; otherwise + // fall back to the preview's auto-match; otherwise (no match) create-new + // ONLY if the create-missing flag is set, else fail with a clear message. + var nameMap = BuildNameMap(cmd, preview); + + // Dedupe by (EntityType, Name) -- the preview can emit multiple rows per + // entity (e.g. one row per modified member of a template), but ApplyAsync + // requires a unique resolution per key. Last-write-wins matches the + // Central UI's TransportImport.BuildDefaultResolutions behavior. For + // DataConnection rows the preview item Name is already site-qualified + // ({site}/{name}), so keying generically by (EntityType, Name) is + // automatically correct — no bare-connection-name special case needed. + var renameStamp = DateTime.UtcNow.ToString("yyyyMMdd-HHmmss"); + var resolutionsMap = new Dictionary<(string, string), ImportResolution>(); + foreach (var item in preview.Items) + { + var action = item.Kind switch + { + ConflictKind.New => ResolutionAction.Add, + ConflictKind.Identical => ResolutionAction.Skip, + ConflictKind.Modified => policy, + _ => ResolutionAction.Skip, + }; + var renameTo = (item.Kind == ConflictKind.Modified && policy == ResolutionAction.Rename) + ? $"{item.Name}-imported-{renameStamp}" + : null; + resolutionsMap[(item.EntityType, item.Name)] = new ImportResolution( + item.EntityType, item.Name, action, renameTo); + } + + return await importer.ApplyAsync( + session.SessionId, resolutionsMap.Values.ToList(), username, nameMap: nameMap); + } + finally + { + importer.Abandon(session.SessionId); + } } finally { diff --git a/src/ZB.MOM.WW.ScadaBridge.Transport/Import/BundleImporter.cs b/src/ZB.MOM.WW.ScadaBridge.Transport/Import/BundleImporter.cs index ef5a9932..ffbc646c 100644 --- a/src/ZB.MOM.WW.ScadaBridge.Transport/Import/BundleImporter.cs +++ b/src/ZB.MOM.WW.ScadaBridge.Transport/Import/BundleImporter.cs @@ -1715,6 +1715,32 @@ public sealed class BundleImporter : IBundleImporter } } + /// + /// + /// Register row 43: every abandonment path (Central UI wizard reset / + /// back-to-upload / circuit teardown, CLI preview, CLI import that aborts + /// before Apply) funnels here so a session that will never be applied stops + /// holding one of the MaxConcurrentImportSessions slots — and stops + /// holding its decrypted plaintext — for the rest of its TTL. Applies the same + /// zero-then-remove ordering as the T-007 release inside + /// : zeroing first means a caller still holding the + /// session reference (the Razor page keeps one for the Result step) observes + /// the cleared buffer too. + /// + public void Abandon(Guid sessionId) + { + // Get() returns null for an unknown or already-expired id, which makes the + // double-release after ApplyAsync (which already removed it) a no-op rather + // than a throw. Remove is called unconditionally so an expired-but-still- + // resident entry is dropped as well. + var session = _sessionStore.Get(sessionId); + if (session is not null) + { + ZeroDecryptedContent(session); + } + _sessionStore.Remove(sessionId); + } + /// /// Enumerates the deployed instances stale-ed by this import. /// Overwriting a template changes the flattened-config hash of every instance diff --git a/tests/ZB.MOM.WW.ScadaBridge.CentralUI.Tests/Pages/Design/TransportImportPageTests.cs b/tests/ZB.MOM.WW.ScadaBridge.CentralUI.Tests/Pages/Design/TransportImportPageTests.cs index c1b13770..0848a963 100644 --- a/tests/ZB.MOM.WW.ScadaBridge.CentralUI.Tests/Pages/Design/TransportImportPageTests.cs +++ b/tests/ZB.MOM.WW.ScadaBridge.CentralUI.Tests/Pages/Design/TransportImportPageTests.cs @@ -17,6 +17,7 @@ using ZB.MOM.WW.ScadaBridge.Commons.Types.Transport; using ZB.MOM.WW.ScadaBridge.ConfigurationDatabase; using ZB.MOM.WW.ScadaBridge.Security; using ZB.MOM.WW.ScadaBridge.Transport; +using ZB.MOM.WW.ScadaBridge.Transport.Import; using TransportImportPage = ZB.MOM.WW.ScadaBridge.CentralUI.Components.Pages.Design.TransportImport; namespace ZB.MOM.WW.ScadaBridge.CentralUI.Tests.Pages.Design; @@ -688,6 +689,191 @@ public class TransportImportPageTests : BunitContext Assert.Empty(connChoices); } + // ───────────────────────────────────────────────────────────────────── + // Register row 43: an abandoned wizard must not strand its server-side + // BundleSession. These tests swap the NSubstitute importer for one backed + // by a REAL BundleSessionStore so the assertion is "the slot is actually + // released", not "a mock was called". + // ───────────────────────────────────────────────────────────────────── + + /// + /// Minimal over a real . + /// and mirror the production + /// importer's zero-then-remove release; every other member is unused by these + /// tests. Sessions are seeded directly with because + /// driving InputFile from bUnit is impractical (see the class remarks). + /// + private sealed class StoreBackedImporter : IBundleImporter + { + public BundleSessionStore Store { get; } = new( + Microsoft.Extensions.Options.Options.Create(new TransportOptions()), + TimeProvider.System); + + public int AbandonCalls { get; private set; } + + public BundleSession OpenSession(string sourceEnv = "prod-cluster") + { + var seed = BuildEncryptedSession(sourceEnv); + var session = new BundleSession + { + SessionId = seed.SessionId, + Manifest = seed.Manifest, + // Non-zero bytes so the zeroing assertion is meaningful. + DecryptedContent = new byte[] { 0x11, 0x22, 0x33, 0x44 }, + ExpiresAt = DateTimeOffset.UtcNow.AddMinutes(30), + }; + return Store.Open(session); + } + + public Task LoadAsync(Stream bundleStream, string? passphrase, CancellationToken ct = default) + => throw new NotSupportedException("These tests seed sessions via OpenSession()."); + + public Task PreviewAsync(Guid sessionId, CancellationToken ct = default) + => Task.FromResult(new ImportPreview(sessionId, new List())); + + public Task ApplyAsync( + Guid sessionId, + IReadOnlyList resolutions, + string user, + CancellationToken ct = default, + BundleNameMap? nameMap = null) + { + Release(sessionId); + return Task.FromResult(new ImportResult( + BundleImportId: Guid.NewGuid(), + Added: 1, + Overwritten: 0, + Skipped: 0, + Renamed: 0, + StaleInstanceIds: Array.Empty(), + AuditEventCorrelation: Guid.NewGuid().ToString())); + } + + public void Abandon(Guid sessionId) + { + AbandonCalls++; + Release(sessionId); + } + + private void Release(Guid sessionId) + { + var session = Store.Get(sessionId); + if (session is { DecryptedContent.Length: > 0 }) + { + Array.Clear(session.DecryptedContent, 0, session.DecryptedContent.Length); + } + Store.Remove(sessionId); + } + } + + [Fact] + public async Task Disposing_the_wizard_releases_its_bundle_session() + { + // Circuit teardown / navigation away. Before the fix, Dispose deleted only + // the staged temp file, so the session (and its decrypted content) held one + // of MaxConcurrentImportSessions for the full 30-minute TTL. + var importer = new StoreBackedImporter(); + Services.AddSingleton(importer); + + var cut = Render(); + var session = importer.OpenSession(); + var content = session.DecryptedContent; + await cut.InvokeAsync(() => SetField(cut.Instance, "_session", session)); + + cut.Instance.Dispose(); + + Assert.Null(importer.Store.Get(session.SessionId)); + Assert.All(content, b => Assert.Equal(0, b)); + Assert.Null(GetField(cut.Instance, "_session")); + } + + [Fact] + public async Task BackToUpload_releases_the_bundle_session() + { + // The wizard's only cancel affordance ("Back" on steps 2/3/5) routes through + // BackToUpload → ResetSessionState, which used to null the local field only. + var importer = new StoreBackedImporter(); + Services.AddSingleton(importer); + + var cut = Render(); + var session = importer.OpenSession(); + var content = session.DecryptedContent; + await cut.InvokeAsync(() => + { + SetField(cut.Instance, "_session", session); + SetField(cut.Instance, "_step", TransportImportPage.ImportWizardStep.Diff); + }); + + await cut.InvokeAsync(() => + { + var method = cut.Instance.GetType().GetMethod( + "BackToUpload", + System.Reflection.BindingFlags.Instance | System.Reflection.BindingFlags.NonPublic)!; + method.Invoke(cut.Instance, Array.Empty()); + }); + + Assert.Null(importer.Store.Get(session.SessionId)); + Assert.All(content, b => Assert.Equal(0, b)); + } + + [Fact] + public async Task Apply_then_dispose_releases_the_session_once_without_throwing() + { + // ApplyAsync already removes the session; the wizard's own release must be + // idempotent so circuit teardown after a completed import is a silent no-op. + var importer = new StoreBackedImporter(); + Services.AddSingleton(importer); + + var cut = Render(); + var session = importer.OpenSession(sourceEnv: "prod-cluster"); + await cut.InvokeAsync(() => + { + SetField(cut.Instance, "_session", session); + SetField(cut.Instance, "_resolutions", + new Dictionary<(string EntityType, string Name), ImportResolution> + { + [("Template", "Pump")] = new("Template", "Pump", ResolutionAction.Add, null), + }); + SetField(cut.Instance, "_step", TransportImportPage.ImportWizardStep.Confirm); + SetField(cut.Instance, "_confirmEnvironmentText", "prod-cluster"); + }); + + await cut.InvokeAsync(() => InvokeAsyncMethod(cut.Instance, "ApplyAsync")); + Assert.Equal( + TransportImportPage.ImportWizardStep.Result, + GetField(cut.Instance, "_step")); + Assert.Null(importer.Store.Get(session.SessionId)); + + // Must not throw, and must not resurrect or double-release anything. + cut.Instance.Dispose(); + cut.Instance.Dispose(); + + Assert.Null(importer.Store.Get(session.SessionId)); + } + + [Fact] + public async Task Disposing_one_wizard_leaves_a_concurrent_circuits_session_open() + { + // Sessions are keyed by a GUID held only by the circuit that opened them, + // so one operator abandoning their import must not evict another's. + var importer = new StoreBackedImporter(); + Services.AddSingleton(importer); + + var first = Render(); + var second = Render(); + var mine = importer.OpenSession(); + var theirs = importer.OpenSession(sourceEnv: "other-cluster"); + await first.InvokeAsync(() => SetField(first.Instance, "_session", mine)); + await second.InvokeAsync(() => SetField(second.Instance, "_session", theirs)); + + first.Instance.Dispose(); + + Assert.Null(importer.Store.Get(mine.SessionId)); + var survivor = importer.Store.Get(theirs.SessionId); + Assert.NotNull(survivor); + Assert.Contains(survivor!.DecryptedContent, b => b != 0); + } + // ───────────────────────────────────────────────────────────────────── // Reflection helpers — the wizard's per-instance state is private (the // razor partial pattern). We poke at it via reflection rather than diff --git a/tests/ZB.MOM.WW.ScadaBridge.Transport.Tests/Import/BundleImporterLoadTests.cs b/tests/ZB.MOM.WW.ScadaBridge.Transport.Tests/Import/BundleImporterLoadTests.cs index 0059fb79..2148f7f0 100644 --- a/tests/ZB.MOM.WW.ScadaBridge.Transport.Tests/Import/BundleImporterLoadTests.cs +++ b/tests/ZB.MOM.WW.ScadaBridge.Transport.Tests/Import/BundleImporterLoadTests.cs @@ -502,6 +502,92 @@ public sealed class BundleImporterLoadTests () => rig.Importer.LoadAsync(stream, passphrase: null)); } + // ───────────────────────────────────────────────────────────────────── + // Register row 43 — abandoned-session release. + // ───────────────────────────────────────────────────────────────────── + + [Fact] + public async Task Abandon_releases_the_session_slot_and_zeroes_its_decrypted_content() + { + // Row 43: only ApplyAsync used to release a session, so any caller that + // loaded a bundle and walked away held one of MaxConcurrentImportSessions + // (plus the decrypted plaintext) for the full TTL. + var rig = BuildRig(); + using var packed = PackEncryptedBundle( + rig.Serializer, rig.ManifestBuilder, rig.Encryptor, SmallContent(), "correct"); + var session = await rig.Importer.LoadAsync( + new MemoryStream(((MemoryStream)packed).ToArray()), passphrase: "correct"); + + var decrypted = session.DecryptedContent; + Assert.NotEmpty(decrypted); + Assert.Contains(decrypted, b => b != 0); + Assert.NotNull(rig.SessionStore.Get(session.SessionId)); + + rig.Importer.Abandon(session.SessionId); + + Assert.Null(rig.SessionStore.Get(session.SessionId)); + // Zeroed in place, so even a caller still holding the reference (the Razor + // page keeps one for the Result step) can no longer read the plaintext. + Assert.All(decrypted, b => Assert.Equal(0, b)); + } + + [Fact] + public async Task Abandon_is_idempotent_and_tolerates_unknown_ids() + { + // The Razor page calls Abandon from Dispose even after a successful Apply + // already released the same id; a double release must be a silent no-op. + var rig = BuildRig(); + using var packed = PackPlainBundle(rig.Serializer, rig.ManifestBuilder, SmallContent()); + var session = await rig.Importer.LoadAsync(packed, passphrase: null); + + rig.Importer.Abandon(session.SessionId); + rig.Importer.Abandon(session.SessionId); + rig.Importer.Abandon(Guid.NewGuid()); + + Assert.Null(rig.SessionStore.Get(session.SessionId)); + } + + [Fact] + public async Task Abandon_does_not_release_another_callers_session() + { + // Sessions are keyed by a random GUID handed only to their opener, so one + // operator abandoning their wizard must not evict a concurrent import. + var rig = BuildRig(); + using var packedA = PackPlainBundle(rig.Serializer, rig.ManifestBuilder, SmallContent()); + using var packedB = PackPlainBundle(rig.Serializer, rig.ManifestBuilder, EmptyContent()); + var a = await rig.Importer.LoadAsync(packedA, passphrase: null); + var b = await rig.Importer.LoadAsync(packedB, passphrase: null); + + rig.Importer.Abandon(a.SessionId); + + Assert.Null(rig.SessionStore.Get(a.SessionId)); + var survivor = rig.SessionStore.Get(b.SessionId); + Assert.NotNull(survivor); + Assert.NotEmpty(survivor!.DecryptedContent); + } + + [Fact] + public async Task Abandon_frees_a_concurrent_import_session_slot() + { + // The availability half of row 43: abandoned sessions used to exhaust the + // cap and lock out every import on the node until the TTL expired. + var rig = BuildRig(opts => opts.MaxConcurrentImportSessions = 2); + using var packed = PackPlainBundle(rig.Serializer, rig.ManifestBuilder, SmallContent()); + var bundleBytes = ((MemoryStream)packed).ToArray(); + + var first = await rig.Importer.LoadAsync(new MemoryStream(bundleBytes), passphrase: null); + await rig.Importer.LoadAsync(new MemoryStream(bundleBytes), passphrase: null); + + var full = await Assert.ThrowsAsync( + () => rig.Importer.LoadAsync(new MemoryStream(bundleBytes), passphrase: null)); + Assert.Contains("Too many concurrent import sessions", full.Message); + + rig.Importer.Abandon(first.SessionId); + + var third = await rig.Importer.LoadAsync(new MemoryStream(bundleBytes), passphrase: null); + Assert.NotNull(rig.SessionStore.Get(third.SessionId)); + } + /// /// Builds a zip directly so the test can write a manifest whose /// ContentHash or BundleFormatVersion intentionally