Resolve all 33 medium-severity architecture review findings
Second slice of the 2026-09-09 whole-system review remediation
(docs/plans/2026-09-09-arch-review.md §10), on top of the High slice 146a1323.
Runtime/devices: SR-2 alarm on-trigger integration scope; SR-3 correlated NativeAlarmActor
subscribe retry; SR-4 immutable audited DB target; SR-5 ordered InstanceActor stop/flush;
SR-12 rehydration fence; SR-13 S&F gate recheck per delivery; DC-4 no OPC UA security
downgrade; DC-5 alarm snapshot for every new subscriber; ORCH-1 sync-dispose joins the pump.
Management/UI: MG-2 site scope on audit tree + Flow Debugger Replay; MG-3 stale-probe memo
removed; MG-4 server-owned bulk-deploy deadline; UI-5 sandbox runs in a killable child
process (new CentralUI.SandboxWorker project); UI-14 bounded sandbox output/IPC.
Edge/audit: EI-1 relay audit ownership; EI-2 SkipBodyCapture suppresses error text; EI-3/EI-11
error-field redaction + caps; EI-4 single relay deadline, pre-execution-only retry; EI-5
authenticated relay provenance; EI-10 body cap before audit read.
Persistence/contracts: DL-1 global Instance.UniqueName unique index + conflict translation;
DL-2 DataConnection protocol config encrypted at rest (migration
20260909203046_EnforceGlobalInstanceNamesAndProtectProtocolConfiguration — coordinated
central upgrade, old binaries cannot read protected rows); DL-3 bounded Replay paging;
DL-6 cross-site Overwrite of a deployed instance rejected; XC-4 proto descriptor contract test.
Config/hygiene: XC-1 central listener isolation by local port; XC-2/XC-3 inert SMTP + cron
keys removed from rig settings; CM-2 env2 bootstrap guard enabled; DC-6 deploy site exit code;
DC-7 notifier retries only explicit standby rejection; XC-5 ClusterClient purged from docs.
Gates recorded in the report: build 0/0, 9 397 passed / 0 failed, rig redeployed on all
eight nodes with the migration applied. 46 Low findings remain open.
This commit is contained in:
Joseph Doherty
+98
@@ -0,0 +1,98 @@
|
||||
using Microsoft.AspNetCore.DataProtection;
|
||||
using Microsoft.EntityFrameworkCore;
|
||||
using ZB.MOM.WW.ScadaBridge.Commons.Entities.Instances;
|
||||
using ZB.MOM.WW.ScadaBridge.Commons.Entities.Sites;
|
||||
|
||||
namespace ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.Tests;
|
||||
|
||||
public class MediumPersistenceRegressionTests
|
||||
{
|
||||
private static ScadaBridgeDbContext Create(bool protectedWrites = true)
|
||||
{
|
||||
var options = new DbContextOptionsBuilder<ScadaBridgeDbContext>()
|
||||
.UseSqlite("Data Source=:memory:;Foreign Keys=False").Options;
|
||||
var db = protectedWrites ? new ScadaBridgeDbContext(options, new EphemeralDataProtectionProvider())
|
||||
: new ScadaBridgeDbContext(options);
|
||||
db.Database.OpenConnection();
|
||||
db.Database.EnsureCreated();
|
||||
return db;
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task DL1_UniqueNameCannotExistAtTwoSites()
|
||||
{
|
||||
await using var db = Create();
|
||||
db.Instances.Add(new Instance("shared-pump") { SiteId = 1, TemplateId = 1 });
|
||||
await db.SaveChangesAsync();
|
||||
db.Instances.Add(new Instance("shared-pump") { SiteId = 2, TemplateId = 1 });
|
||||
await Assert.ThrowsAsync<InstanceNameConflictException>(() => db.SaveChangesAsync());
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task DL2_ConvertersDoNotShareKeysAcrossProviders()
|
||||
{
|
||||
await using var connection = new Microsoft.Data.Sqlite.SqliteConnection("Data Source=:memory:;Foreign Keys=False");
|
||||
await connection.OpenAsync();
|
||||
var options = new DbContextOptionsBuilder<ScadaBridgeDbContext>().UseSqlite(connection).Options;
|
||||
await using (var first = new ScadaBridgeDbContext(options, new EphemeralDataProtectionProvider()))
|
||||
{
|
||||
await first.Database.EnsureCreatedAsync();
|
||||
first.DataConnections.Add(new DataConnection("key-isolation", "OpcUa", 1) { PrimaryConfiguration = "{}" });
|
||||
await first.SaveChangesAsync();
|
||||
}
|
||||
await using var wrongKey = new ScadaBridgeDbContext(options, new EphemeralDataProtectionProvider());
|
||||
await Assert.ThrowsAsync<System.Security.Cryptography.CryptographicException>(() =>
|
||||
wrongKey.DataConnections.SingleAsync(c => c.Name == "key-isolation"));
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task DL2_LegacyUpgradeProtectsBothColumnsAndIsIdempotent()
|
||||
{
|
||||
await using var db = Create();
|
||||
await db.Database.ExecuteSqlRawAsync("INSERT INTO DataConnections (SiteId, Name, Protocol, PrimaryConfiguration, BackupConfiguration, FailoverRetryCount) VALUES (1, 'legacy', 'OpcUa', {0}, {1}, 3)",
|
||||
"""{"Password":"primary-secret"}""", """{"Password":"backup-secret"}""");
|
||||
await DataConnectionSecretUpgrade.UpgradeAsync(db);
|
||||
await using var command = db.Database.GetDbConnection().CreateCommand();
|
||||
command.CommandText = "SELECT PrimaryConfiguration FROM DataConnections WHERE Name = 'legacy'";
|
||||
var first = (string)(await command.ExecuteScalarAsync())!;
|
||||
Assert.DoesNotContain("primary-secret", first);
|
||||
await DataConnectionSecretUpgrade.UpgradeAsync(db);
|
||||
Assert.Equal(first, (string)(await command.ExecuteScalarAsync())!);
|
||||
var row = await db.DataConnections.SingleAsync(c => c.Name == "legacy");
|
||||
Assert.Contains("primary-secret", row.PrimaryConfiguration);
|
||||
Assert.Contains("backup-secret", row.BackupConfiguration);
|
||||
}
|
||||
|
||||
[Theory]
|
||||
[InlineData(false)]
|
||||
[InlineData(true)]
|
||||
public async Task DL2_DataConnectionConfigurationIsEncryptedAndRoundTrips(bool backup)
|
||||
{
|
||||
await using var db = Create();
|
||||
const string secret = "{\"Password\":\"medium-secret-never-plaintext\"}";
|
||||
var connection = new DataConnection("test", "OpcUa", 1);
|
||||
if (backup) connection.BackupConfiguration = secret; else connection.PrimaryConfiguration = secret;
|
||||
db.DataConnections.Add(connection);
|
||||
await db.SaveChangesAsync();
|
||||
db.ChangeTracker.Clear();
|
||||
await using var cmd = db.Database.GetDbConnection().CreateCommand();
|
||||
cmd.CommandText = $"SELECT {(backup ? "BackupConfiguration" : "PrimaryConfiguration")} FROM DataConnections WHERE Id = {connection.Id}";
|
||||
var raw = Assert.IsType<string>(await cmd.ExecuteScalarAsync());
|
||||
Assert.DoesNotContain("medium-secret", raw);
|
||||
var loaded = await db.DataConnections.SingleAsync(c => c.Id == connection.Id);
|
||||
Assert.Equal(secret, backup ? loaded.BackupConfiguration : loaded.PrimaryConfiguration);
|
||||
}
|
||||
|
||||
[Theory]
|
||||
[InlineData(false)]
|
||||
[InlineData(true)]
|
||||
public async Task DL2_SchemaOnlyContextCannotWriteProtocolCredentials(bool backup)
|
||||
{
|
||||
await using var db = Create(false);
|
||||
var connection = new DataConnection("test", "OpcUa", 1);
|
||||
if (backup) connection.BackupConfiguration = "{}"; else connection.PrimaryConfiguration = "{}";
|
||||
db.DataConnections.Add(connection);
|
||||
var error = await Assert.ThrowsAsync<InvalidOperationException>(() => db.SaveChangesAsync());
|
||||
Assert.Contains("Data Protection", error.Message);
|
||||
}
|
||||
}
|
||||
+77
@@ -0,0 +1,77 @@
|
||||
using Microsoft.AspNetCore.DataProtection;
|
||||
using Microsoft.Data.SqlClient;
|
||||
using Microsoft.EntityFrameworkCore;
|
||||
using Microsoft.EntityFrameworkCore.Migrations;
|
||||
using Microsoft.EntityFrameworkCore.Migrations.Operations;
|
||||
using ZB.MOM.WW.ScadaBridge.Commons.Entities.Instances;
|
||||
using ZB.MOM.WW.ScadaBridge.Commons.Entities.Sites;
|
||||
using ZB.MOM.WW.ScadaBridge.Commons.Entities.Templates;
|
||||
using ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.Migrations;
|
||||
|
||||
namespace ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.Tests.Migrations;
|
||||
|
||||
public class MediumPersistenceSqlTests : IClassFixture<MsSqlMigrationFixture>
|
||||
{
|
||||
private readonly MsSqlMigrationFixture _fixture;
|
||||
public MediumPersistenceSqlTests(MsSqlMigrationFixture fixture) => _fixture = fixture;
|
||||
|
||||
[SkippableFact]
|
||||
public async Task RealSql_GlobalNameRaceAndLegacyCredentialUpgrade()
|
||||
{
|
||||
Skip.IfNot(_fixture.Available, _fixture.SkipReason);
|
||||
var options = new DbContextOptionsBuilder<ScadaBridgeDbContext>().UseSqlServer(_fixture.ConnectionString).Options;
|
||||
var protection = new EphemeralDataProtectionProvider();
|
||||
await using var db = new ScadaBridgeDbContext(options, protection);
|
||||
var a = new Site("Medium A", "medium-a"); var b = new Site("Medium B", "medium-b");
|
||||
var template = new Template("Medium template");
|
||||
db.AddRange(a, b, template);
|
||||
await db.SaveChangesAsync();
|
||||
async Task<bool> Insert(int site)
|
||||
{
|
||||
await using var attempt = new ScadaBridgeDbContext(options, protection);
|
||||
attempt.Instances.Add(new Instance("global-medium-pump") { SiteId = site, TemplateId = template.Id });
|
||||
try { await attempt.SaveChangesAsync(); return true; }
|
||||
catch (InstanceNameConflictException) { return false; }
|
||||
}
|
||||
var race = await Task.WhenAll(Insert(a.Id), Insert(b.Id));
|
||||
Assert.Single(race, success => success);
|
||||
Assert.Single(race, success => !success);
|
||||
await db.Database.ExecuteSqlRawAsync(
|
||||
"INSERT INTO DataConnections (SiteId, Name, Protocol, PrimaryConfiguration, BackupConfiguration, FailoverRetryCount) VALUES ({0}, 'legacy-medium', 'OpcUa', {1}, {2}, 3)",
|
||||
a.Id, """{"password":"sql-primary-secret"}""", """{"password":"sql-backup-secret"}""");
|
||||
await DataConnectionSecretUpgrade.UpgradeAsync(db);
|
||||
await DataConnectionSecretUpgrade.UpgradeAsync(db);
|
||||
var protectedRow = await db.DataConnections.SingleAsync(c => c.Name == "legacy-medium");
|
||||
Assert.Contains("sql-primary-secret", protectedRow.PrimaryConfiguration);
|
||||
Assert.Contains("sql-backup-secret", protectedRow.BackupConfiguration);
|
||||
|
||||
using var connection = _fixture.OpenConnection();
|
||||
using var raw = connection.CreateCommand();
|
||||
raw.CommandText = "SELECT PrimaryConfiguration FROM DataConnections WHERE Name = 'legacy-medium'";
|
||||
Assert.DoesNotContain("sql-primary-secret", (string)(await raw.ExecuteScalarAsync())!);
|
||||
raw.CommandText = "SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME='DataConnections' AND COLUMN_NAME IN ('PrimaryConfiguration','BackupConfiguration') AND CHARACTER_MAXIMUM_LENGTH=-1";
|
||||
Assert.Equal(2, (int)(await raw.ExecuteScalarAsync())!);
|
||||
|
||||
// A pre-upgrade conflict is rejected explicitly; the transaction restores the index.
|
||||
using var transaction = connection.BeginTransaction();
|
||||
using var legacy = connection.CreateCommand();
|
||||
legacy.Transaction = transaction;
|
||||
legacy.CommandText = "DROP INDEX IX_Instances_UniqueName ON Instances";
|
||||
await legacy.ExecuteNonQueryAsync();
|
||||
legacy.CommandText = "INSERT INTO Instances (UniqueName, TemplateId, SiteId, State) VALUES ('global-medium-pump', @template, @site, 'NotDeployed')";
|
||||
legacy.Parameters.AddWithValue("@template", template.Id);
|
||||
legacy.Parameters.AddWithValue("@site", a.Id);
|
||||
await legacy.ExecuteNonQueryAsync();
|
||||
var builder = new MigrationBuilder("Microsoft.EntityFrameworkCore.SqlServer");
|
||||
new ProbeMigration().Apply(builder);
|
||||
legacy.CommandText = builder.Operations.OfType<SqlOperation>().First().Sql;
|
||||
var denied = await Assert.ThrowsAsync<SqlException>(() => legacy.ExecuteNonQueryAsync());
|
||||
Assert.Equal(51002, denied.Number);
|
||||
transaction.Rollback();
|
||||
}
|
||||
|
||||
private sealed class ProbeMigration : EnforceGlobalInstanceNamesAndProtectProtocolConfiguration
|
||||
{
|
||||
public void Apply(MigrationBuilder builder) => base.Up(builder);
|
||||
}
|
||||
}
|
||||
+42
@@ -22,6 +22,48 @@ public class AuditLogRepositoryTraceEventsTests : IClassFixture<MsSqlMigrationFi
|
||||
private ScadaBridgeDbContext CreateContext() => new(
|
||||
new DbContextOptionsBuilder<ScadaBridgeDbContext>().UseSqlServer(_fixture.ConnectionString).Options);
|
||||
|
||||
[SkippableFact]
|
||||
public async Task ScopedTreeAndReplay_ExcludeOtherSite_AndRetainCentralRows()
|
||||
{
|
||||
Skip.IfNot(_fixture.Available, _fixture.SkipReason);
|
||||
var root = Guid.NewGuid(); var childA = Guid.NewGuid(); var childB = Guid.NewGuid();
|
||||
var central = ScadaBridgeAuditEventFactory.Create(AuditChannel.ApiInbound, AuditKind.InboundRequest, AuditStatus.Delivered, executionId: root);
|
||||
var allowed = ScadaBridgeAuditEventFactory.Create(AuditChannel.ScriptTrace, AuditKind.ScriptRun, AuditStatus.Delivered, executionId: childA, parentExecutionId: root, sourceSiteId: "site-a");
|
||||
var denied = ScadaBridgeAuditEventFactory.Create(AuditChannel.DbOutbound, AuditKind.DbWrite, AuditStatus.Delivered, executionId: childB, parentExecutionId: root, sourceSiteId: "site-b", responseSummary: "sensitive-sql-values");
|
||||
await using var context = CreateContext(); var repo = new AuditLogRepository(context);
|
||||
foreach (var row in new[] { central, allowed, denied }) await repo.InsertIfNotExistsAsync(row);
|
||||
var tree = await repo.GetExecutionTreeAsync(childA, permittedSiteIds: new[] { "site-a" });
|
||||
Assert.Contains(tree, node => node.ExecutionId == root);
|
||||
Assert.DoesNotContain(tree, node => node.ExecutionId == childB);
|
||||
var replay = await repo.GetTraceEventsAsync(childA, permittedSiteIds: new[] { "site-a" });
|
||||
Assert.Equal(new[] { central.EventId, allowed.EventId }.Order(), replay.Select(e => e.EventId).Order());
|
||||
Assert.DoesNotContain(replay, row => row.DetailsJson?.Contains("sensitive-sql-values") == true);
|
||||
}
|
||||
|
||||
[SkippableTheory]
|
||||
[InlineData(600, 0)]
|
||||
[InlineData(200, 10000)]
|
||||
[InlineData(1, 1100000)]
|
||||
public async Task Replay_BoundsRowsAndUtf8Bytes_AndKeepsRoot(int count, int payloadLength)
|
||||
{
|
||||
Skip.IfNot(_fixture.Available, _fixture.SkipReason);
|
||||
var root = Guid.NewGuid(); var start = DateTime.UtcNow;
|
||||
await using var context = CreateContext(); var repo = new AuditLogRepository(context);
|
||||
for (var i = 0; i < count; i++)
|
||||
await repo.InsertIfNotExistsAsync(ScadaBridgeAuditEventFactory.Create(AuditChannel.ScriptTrace,
|
||||
AuditKind.ScriptRun, AuditStatus.Delivered, executionId: root, occurredAtUtc: payloadLength == 0 ? start : start.AddMilliseconds(i),
|
||||
responseSummary: new string('界', payloadLength)));
|
||||
var rows = await repo.GetTraceEventsAsync(root);
|
||||
var batch = Assert.IsType<TraceEventBatch>(rows);
|
||||
Assert.True(batch.Truncated);
|
||||
Assert.Equal(root, batch.RootExecutionId);
|
||||
Assert.True(batch.Count <= 500);
|
||||
if (payloadLength == 0) Assert.Equal(500, batch.Count);
|
||||
if (payloadLength > 1024 * 1024) Assert.Empty(batch);
|
||||
Assert.Equal(batch.Count, batch.Select(e => e.EventId).Distinct().Count());
|
||||
Assert.True(batch.Sum(e => System.Text.Json.JsonSerializer.SerializeToUtf8Bytes(e).Length) <= 1024 * 1024);
|
||||
}
|
||||
|
||||
[SkippableFact]
|
||||
public async Task ReturnsInboundPlusChainTraceRows_Ordered_FromAnyEntry()
|
||||
{
|
||||
|
||||
Reference in New Issue
Block a user