fix(security): additive permitted-sites filter on secured-write query/count (plan R2-07 T5)

src/ZB.MOM.WW.ScadaBridge.Commons/Interfaces/Repositories/ISecuredWriteRepository.cs

@@ -46,6 +46,11 @@ public interface ISecuredWriteRepository
     /// <param name="siteId">Site id filter; <c>null</c> matches every site.</param>
     /// <param name="skip">Number of rows to skip (offset paging).</param>
     /// <param name="take">Maximum number of rows to return.</param>
+    /// <param name="permittedSiteIds">When non-null, only rows whose <c>SiteId</c> (site
+    /// identifier) is in the set match; <c>null</c> matches every site. Applied IN ADDITION
+    /// to <paramref name="siteId"/>. Used by the ManagementActor to constrain an unfiltered
+    /// list to a site-scoped caller's permitted sites at the query level (arch-review R2 N3),
+    /// so paging and totals stay correct.</param>
     /// <param name="ct">Cancellation token.</param>
     /// <returns>A task that resolves to a page of matching rows, newest submission first.</returns>
     Task<IReadOnlyList<PendingSecuredWrite>> QueryAsync(
@@ -53,6 +58,7 @@ public interface ISecuredWriteRepository
         string? siteId,
         int skip,
         int take,
+        IReadOnlyCollection<string>? permittedSiteIds = null,
         CancellationToken ct = default);
 
     /// <summary>
@@ -106,7 +112,16 @@ public interface ISecuredWriteRepository
     /// </summary>
     /// <param name="status">Status filter; <c>null</c> matches every status.</param>
     /// <param name="siteId">Site id filter; <c>null</c> matches every site.</param>
+    /// <param name="permittedSiteIds">When non-null, only rows whose <c>SiteId</c> (site
+    /// identifier) is in the set match; <c>null</c> matches every site. Applied IN ADDITION
+    /// to <paramref name="siteId"/>. Used by the ManagementActor to constrain an unfiltered
+    /// list to a site-scoped caller's permitted sites at the query level (arch-review R2 N3),
+    /// so paging and totals stay correct.</param>
     /// <param name="ct">Cancellation token.</param>
     /// <returns>A task that resolves to the count of matching rows.</returns>
-    Task<int> CountAsync(string? status, string? siteId, CancellationToken ct = default);
+    Task<int> CountAsync(
+        string? status,
+        string? siteId,
+        IReadOnlyCollection<string>? permittedSiteIds = null,
+        CancellationToken ct = default);
 }

src/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase/Repositories/SecuredWriteRepository.cs

@@ -57,6 +57,7 @@ public class SecuredWriteRepository : ISecuredWriteRepository
         string? siteId,
         int skip,
         int take,
+        IReadOnlyCollection<string>? permittedSiteIds = null,
         CancellationToken ct = default)
     {
         IQueryable<PendingSecuredWrite> query = _context.Set<PendingSecuredWrite>()
@@ -72,6 +73,11 @@ public class SecuredWriteRepository : ISecuredWriteRepository
             query = query.Where(p => p.SiteId == siteId);
         }
 
+        if (permittedSiteIds is not null)
+        {
+            query = query.Where(p => permittedSiteIds.Contains(p.SiteId));
+        }
+
         return await query
             .OrderByDescending(p => p.SubmittedAtUtc)
             .ThenByDescending(p => p.Id)
@@ -128,7 +134,11 @@ WHERE Id = {id}
     }
 
     /// <inheritdoc />
-    public async Task<int> CountAsync(string? status, string? siteId, CancellationToken ct = default)
+    public async Task<int> CountAsync(
+        string? status,
+        string? siteId,
+        IReadOnlyCollection<string>? permittedSiteIds = null,
+        CancellationToken ct = default)
     {
         IQueryable<PendingSecuredWrite> query = _context.Set<PendingSecuredWrite>()
             .AsNoTracking();
@@ -143,6 +153,11 @@ WHERE Id = {id}
             query = query.Where(p => p.SiteId == siteId);
         }
 
+        if (permittedSiteIds is not null)
+        {
+            query = query.Where(p => permittedSiteIds.Contains(p.SiteId));
+        }
+
         return await query.CountAsync(ct);
     }
 }