Resolve all 46 low-severity architecture review findings

src/ZB.MOM.WW.ScadaBridge.CentralUI/Services/FlowDebugService.cs

@@ -84,6 +84,7 @@ public sealed class FlowDebugService : IFlowDebugService
     private readonly ManagementActorHolder _holder;
     private readonly AuthenticationStateProvider _auth;
     private readonly IInboundApiRepository _inboundApi;
+    private readonly ISiteRepository _sites;
     private readonly ITemplateEngineRepository _templates;
     private readonly IFlatteningPipeline _pipeline;
     private readonly CommunicationService _comms;
@@ -116,8 +117,10 @@ public sealed class FlowDebugService : IFlowDebugService
         ITemplateEngineRepository templates,
         IFlatteningPipeline pipeline,
         CommunicationService comms,
-        ILogger<FlowDebugService> logger)
+        ILogger<FlowDebugService> logger,
+        ISiteRepository sites)
     {
+        _sites = sites ?? throw new ArgumentNullException(nameof(sites));
         _holder = holder ?? throw new ArgumentNullException(nameof(holder));
         _auth = auth ?? throw new ArgumentNullException(nameof(auth));
         _inboundApi = inboundApi ?? throw new ArgumentNullException(nameof(inboundApi));
@@ -322,6 +325,13 @@ public sealed class FlowDebugService : IFlowDebugService
             }
 
             var site = step.SiteId!;
+            var scope = new SiteScopeService(_auth);
+            if (!await scope.IsSystemWideAsync())
+            {
+                var owner = (await _sites.GetAllSitesAsync(ct)).FirstOrDefault(s => s.SiteIdentifier == site);
+                if (owner is null || !await scope.IsSiteAllowedAsync(owner.Id))
+                    return new(false, "You are not permitted to act on cached calls for this site.");
+            }
             SiteCallRelayOutcome outcome;
             bool siteReachable;
             string? errorMessage;