fix(security): additive permitted-sites filter on secured-write query/count (plan R2-07 T5)

src/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase/Repositories/SecuredWriteRepository.cs

@@ -57,6 +57,7 @@ public class SecuredWriteRepository : ISecuredWriteRepository
         string? siteId,
         int skip,
         int take,
+        IReadOnlyCollection<string>? permittedSiteIds = null,
         CancellationToken ct = default)
     {
         IQueryable<PendingSecuredWrite> query = _context.Set<PendingSecuredWrite>()
@@ -72,6 +73,11 @@ public class SecuredWriteRepository : ISecuredWriteRepository
             query = query.Where(p => p.SiteId == siteId);
         }
 
+        if (permittedSiteIds is not null)
+        {
+            query = query.Where(p => permittedSiteIds.Contains(p.SiteId));
+        }
+
         return await query
             .OrderByDescending(p => p.SubmittedAtUtc)
             .ThenByDescending(p => p.Id)
@@ -128,7 +134,11 @@ WHERE Id = {id}
     }
 
     /// <inheritdoc />
-    public async Task<int> CountAsync(string? status, string? siteId, CancellationToken ct = default)
+    public async Task<int> CountAsync(
+        string? status,
+        string? siteId,
+        IReadOnlyCollection<string>? permittedSiteIds = null,
+        CancellationToken ct = default)
     {
         IQueryable<PendingSecuredWrite> query = _context.Set<PendingSecuredWrite>()
             .AsNoTracking();
@@ -143,6 +153,11 @@ WHERE Id = {id}
             query = query.Where(p => p.SiteId == siteId);
         }
 
+        if (permittedSiteIds is not null)
+        {
+            query = query.Where(p => permittedSiteIds.Contains(p.SiteId));
+        }
+
         return await query.CountAsync(ct);
     }
 }