Resolve all 33 medium-severity architecture review findings

Second slice of the 2026-09-09 whole-system review remediation (docs/plans/2026-09-09-arch-review.md §10), on top of the High slice 146a1323. Runtime/devices: SR-2 alarm on-trigger integration scope; SR-3 correlated NativeAlarmActor subscribe retry; SR-4 immutable audited DB target; SR-5 ordered InstanceActor stop/flush; SR-12 rehydration fence; SR-13 S&F gate recheck per delivery; DC-4 no OPC UA security downgrade; DC-5 alarm snapshot for every new subscriber; ORCH-1 sync-dispose joins the pump. Management/UI: MG-2 site scope on audit tree + Flow Debugger Replay; MG-3 stale-probe memo removed; MG-4 server-owned bulk-deploy deadline; UI-5 sandbox runs in a killable child process (new CentralUI.SandboxWorker project); UI-14 bounded sandbox output/IPC. Edge/audit: EI-1 relay audit ownership; EI-2 SkipBodyCapture suppresses error text; EI-3/EI-11 error-field redaction + caps; EI-4 single relay deadline, pre-execution-only retry; EI-5 authenticated relay provenance; EI-10 body cap before audit read. Persistence/contracts: DL-1 global Instance.UniqueName unique index + conflict translation; DL-2 DataConnection protocol config encrypted at rest (migration 20260909203046_EnforceGlobalInstanceNamesAndProtectProtocolConfiguration — coordinated central upgrade, old binaries cannot read protected rows); DL-3 bounded Replay paging; DL-6 cross-site Overwrite of a deployed instance rejected; XC-4 proto descriptor contract test. Config/hygiene: XC-1 central listener isolation by local port; XC-2/XC-3 inert SMTP + cron keys removed from rig settings; CM-2 env2 bootstrap guard enabled; DC-6 deploy site exit code; DC-7 notifier retries only explicit standby rejection; XC-5 ClusterClient purged from docs. Gates recorded in the report: build 0/0, 9 397 passed / 0 failed, rig redeployed on all eight nodes with the migration applied. 46 Low findings remain open.
2026-09-09 22:05:30 -04:00
parent 146a13238f
commit 9a87d7a328
136 changed files with 5441 additions and 648 deletions
@@ -22,6 +22,48 @@ public class AuditLogRepositoryTraceEventsTests : IClassFixture<MsSqlMigrationFi
    private ScadaBridgeDbContext CreateContext() => new(
        new DbContextOptionsBuilder<ScadaBridgeDbContext>().UseSqlServer(_fixture.ConnectionString).Options);

+    [SkippableFact]
+    public async Task ScopedTreeAndReplay_ExcludeOtherSite_AndRetainCentralRows()
+    {
+        Skip.IfNot(_fixture.Available, _fixture.SkipReason);
+        var root = Guid.NewGuid(); var childA = Guid.NewGuid(); var childB = Guid.NewGuid();
+        var central = ScadaBridgeAuditEventFactory.Create(AuditChannel.ApiInbound, AuditKind.InboundRequest, AuditStatus.Delivered, executionId: root);
+        var allowed = ScadaBridgeAuditEventFactory.Create(AuditChannel.ScriptTrace, AuditKind.ScriptRun, AuditStatus.Delivered, executionId: childA, parentExecutionId: root, sourceSiteId: "site-a");
+        var denied = ScadaBridgeAuditEventFactory.Create(AuditChannel.DbOutbound, AuditKind.DbWrite, AuditStatus.Delivered, executionId: childB, parentExecutionId: root, sourceSiteId: "site-b", responseSummary: "sensitive-sql-values");
+        await using var context = CreateContext(); var repo = new AuditLogRepository(context);
+        foreach (var row in new[] { central, allowed, denied }) await repo.InsertIfNotExistsAsync(row);
+        var tree = await repo.GetExecutionTreeAsync(childA, permittedSiteIds: new[] { "site-a" });
+        Assert.Contains(tree, node => node.ExecutionId == root);
+        Assert.DoesNotContain(tree, node => node.ExecutionId == childB);
+        var replay = await repo.GetTraceEventsAsync(childA, permittedSiteIds: new[] { "site-a" });
+        Assert.Equal(new[] { central.EventId, allowed.EventId }.Order(), replay.Select(e => e.EventId).Order());
+        Assert.DoesNotContain(replay, row => row.DetailsJson?.Contains("sensitive-sql-values") == true);
+    }
+
+    [SkippableTheory]
+    [InlineData(600, 0)]
+    [InlineData(200, 10000)]
+    [InlineData(1, 1100000)]
+    public async Task Replay_BoundsRowsAndUtf8Bytes_AndKeepsRoot(int count, int payloadLength)
+    {
+        Skip.IfNot(_fixture.Available, _fixture.SkipReason);
+        var root = Guid.NewGuid(); var start = DateTime.UtcNow;
+        await using var context = CreateContext(); var repo = new AuditLogRepository(context);
+        for (var i = 0; i < count; i++)
+            await repo.InsertIfNotExistsAsync(ScadaBridgeAuditEventFactory.Create(AuditChannel.ScriptTrace,
+                AuditKind.ScriptRun, AuditStatus.Delivered, executionId: root, occurredAtUtc: payloadLength == 0 ? start : start.AddMilliseconds(i),
+                responseSummary: new string('界', payloadLength)));
+        var rows = await repo.GetTraceEventsAsync(root);
+        var batch = Assert.IsType<TraceEventBatch>(rows);
+        Assert.True(batch.Truncated);
+        Assert.Equal(root, batch.RootExecutionId);
+        Assert.True(batch.Count <= 500);
+        if (payloadLength == 0) Assert.Equal(500, batch.Count);
+        if (payloadLength > 1024 * 1024) Assert.Empty(batch);
+        Assert.Equal(batch.Count, batch.Select(e => e.EventId).Distinct().Count());
+        Assert.True(batch.Sum(e => System.Text.Json.JsonSerializer.SerializeToUtf8Bytes(e).Length) <= 1024 * 1024);
+    }
+
    [SkippableFact]
    public async Task ReturnsInboundPlusChainTraceRows_Ordered_FromAnyEntry()
    {