refactor(deployments): one paged read of DeploymentRecords + close its three drifts

Deferred-work register rows 37, 86, 87, 88 — the structural duplication and the three behavioral divergences it had accumulated, fixed together. Row 37 (structural). `IDeploymentManagerRepository.QueryDeploymentSummariesAsync` is DELETED. It and `QueryDeploymentListPageAsync` were two paged reads of the same insert-only table with different contracts — raw offset vs page number, no total vs total, no instance join vs joined, instance-id-list scoping vs site-id scoping. The CLI/HTTP `QueryDeployments` handler now goes through `QueryDeploymentListPageAsync` with a `DeploymentListFilter`, exactly like the Central UI page. The `DeploymentRecordSummary` projection went with it (`DeploymentListRow` is the single row shape); its `MaxPageSize` const moved to `DeploymentListPage`, which also gains `DefaultPageSize`. Row 86 (Medium, authorization — the headline). `SiteScopeService.ResolveAsync` was claims-only, so an Administrator carrying `SiteId` claims saw the whole fleet through the CLI (`ManagementActor.EnforceSiteScope` has always exempted Administrator) and only their granted sites on the Deployments page. One user, one dataset, two answers. Administrator = system-wide is the intended semantic on both sides; the UI was the defect. The role claim is read explicitly with an OrdinalIgnoreCase comparison rather than via `IsInRole`, which compares claim VALUES ordinally and only resolves when the identity carries the matching roleType — the two sides must not disagree on a differently-cased role name. An Administrator's site claims are not collected at all, so the invariant "system-wide => empty permitted-id set" holds for every caller. Designer is NOT exempt: the class doc claimed "any Admin/Design user" is system-wide, which was true of neither side, so the doc was corrected rather than the bypass widened. Row 87 (Low). The scoped branch used to resolve the site grant into an instance-id list by loading EVERY instance in the system, non-transactionally, on every scoped query; the grant now rides as `SiteIdScope` and is resolved by the query's own join. An unparseable permitted-site id is DROPPED, never ignored — dropping can only narrow a grant, discarding it would widen it to fleet-wide. And `PageSize <= 0` no longer means UNLIMITED down at the repository (`--page-size 0` materialized the whole retention window): it means "unspecified" and takes the CLI's own default of 50, capped at 1000. Bounding without telling would be silent truncation, so the handler now returns a `DeploymentQueryResult` envelope carrying `totalCount` plus the page coordinates actually applied — with a CLI table projection (mirroring row 57's `AuditConfigTableProjection`) that unwraps it and appends a "showing N of M" note. Row 88 (Low, UX). An unrecognised `--status` fell back to "no filter", so a typo like `--status Sucess` returned every status — a complete-looking answer to a question the caller never asked. It is now a `ManagementError` naming the valid values. Parsing stays case-insensitive; a numeric string is rejected too, since `Enum.TryParse` accepts "7" and yields an undefined value (guarded with `Enum.IsDefined`). Loud failure over silent full results, per row 46. Tests: 7 new `SiteScopeServiceTests` pinning Administrator = system-wide (verified failing 6/7 against the pre-fix service, the Designer pin passing both ways); the ManagementActor deployment suite migrated onto the consolidated query with new pins for the status error, case-insensitive parse, numeric rejection, page-size default/ cap/floor, empty-scope-on-garbage-grant, and "reads no instances at all"; a repository test for site-scope+status composing over a bounded page; and 6 CLI tests for the new table projection.
2026-08-17 05:15:18 -04:00
parent 15e5887b52
commit 9f67147e7b
21 changed files with 760 additions and 256 deletions
@@ -0,0 +1,89 @@
+using System.Text.Json;
+using ZB.MOM.WW.ScadaBridge.CLI.Commands;
+using ZB.MOM.WW.ScadaBridge.Commons.Messages.Management;
+using ZB.MOM.WW.ScadaBridge.Commons.Types.Deployment;
+using ZB.MOM.WW.ScadaBridge.Commons.Types.Enums;
+
+namespace ZB.MOM.WW.ScadaBridge.CLI.Tests;
+
+/// <summary>
+/// Tests for the <c>deploy status</c> table projection (deferred-work register rows
+/// 37/87). The handler now returns a <see cref="DeploymentQueryResult"/> OBJECT where
+/// it used to return a bare row array; without a projector the generic renderer takes
+/// its Property/Value branch and prints the whole <c>deployments</c> array as raw JSON
+/// inside one cell. The projection unwraps the envelope and keeps the total visible as
+/// a trailing note — which matters more here than for the audit query, because the
+/// page size is bounded server-side and a full page is no longer proof there is
+/// nothing more.
+/// </summary>
+public class DeploymentStatusTableProjectionTests
+{
+    /// <summary>
+    /// The real server shape, serialised from the REAL <see cref="DeploymentQueryResult"/>
+    /// / <see cref="DeploymentListRow"/> types rather than hand-written JSON, so renaming
+    /// one of their properties fails this test instead of silently blanking a column.
+    /// </summary>
+    private static string RealPayload(int rowCount, int totalCount) =>
+        JsonSerializer.Serialize(
+            new DeploymentQueryResult(
+                Enumerable.Range(1, rowCount).Select(i => new DeploymentListRow(
+                    i, $"dep-{i:D3}", i, $"Line3.Pump{i}", 2, DeploymentStatus.Success,
+                    $"rev-{i}", "alice",
+                    new DateTimeOffset(2026, 8, 15, 12, 0, 0, TimeSpan.Zero), null, null)).ToList(),
+                totalCount,
+                Page: 1,
+                PageSize: rowCount),
+            new JsonSerializerOptions { PropertyNamingPolicy = JsonNamingPolicy.CamelCase });
+
+    [Fact]
+    public void Projection_UnwrapsTheEnvelopeToARowArray()
+    {
+        var projected = DeploymentStatusTableProjection.ProjectRows(RealPayload(2, 2));
+
+        using var doc = JsonDocument.Parse(projected);
+        Assert.Equal(JsonValueKind.Array, doc.RootElement.ValueKind);
+        Assert.Equal(2, doc.RootElement.GetArrayLength());
+        Assert.Equal("dep-001", doc.RootElement[0].GetProperty("deploymentId").GetString());
+        Assert.Equal("Line3.Pump1", doc.RootElement[0].GetProperty("instanceUniqueName").GetString());
+    }
+
+    [Fact]
+    public void Projection_WhenPageIsAStrictSubset_AppendsATotalNote()
+    {
+        var projected = DeploymentStatusTableProjection.ProjectRows(RealPayload(2, 57));
+
+        using var doc = JsonDocument.Parse(projected);
+        Assert.Equal(3, doc.RootElement.GetArrayLength());
+        var note = doc.RootElement[2].GetProperty("note").GetString();
+        Assert.Contains("showing 2 of 57", note);
+        Assert.Contains("--page-size", note);
+    }
+
+    [Fact]
+    public void Projection_WhenPageIsTheWholeResult_EmitsNoNoteColumn()
+    {
+        var projected = DeploymentStatusTableProjection.ProjectRows(RealPayload(2, 2));
+
+        using var doc = JsonDocument.Parse(projected);
+        Assert.All(doc.RootElement.EnumerateArray(),
+            e => Assert.False(e.TryGetProperty("note", out _)));
+    }
+
+    [Fact]
+    public void Projection_AcceptsABareRowArray_FromAPreEnvelopeServer()
+    {
+        var projected = DeploymentStatusTableProjection.ProjectRows("""[{"deploymentId":"dep-001"}]""");
+
+        using var doc = JsonDocument.Parse(projected);
+        Assert.Equal("dep-001", Assert.Single(doc.RootElement.EnumerateArray())
+            .GetProperty("deploymentId").GetString());
+    }
+
+    [Theory]
+    [InlineData("not json at all")]
+    [InlineData("""{"error":"boom"}""")]
+    public void Projection_LeavesUnrecognisedBodiesUntouched(string body)
+    {
+        Assert.Equal(body, DeploymentStatusTableProjection.ProjectRows(body));
+    }
+}