fix(secrets): review round 1 — gate the clustered-central secrets warning on Replication:Enabled, name the real trigger in the shared-store connection-string message, pin Grpc-vs-Store:Provider precedence

2026-09-28 17:56:30 -04:00
parent 35235ecfed
commit a57c36f504
5 changed files with 88 additions and 14 deletions
@@ -771,6 +771,25 @@ public class StartupValidatorTests
        Assert.Empty(warnings);
    }

+    [Fact]
+    public void ClusteredCentral_ReplicationEnabled_NoSecretsStoreWarning()
+    {
+        // Review round 1, finding #1: Secrets:Replication:Enabled=true already puts this central
+        // node on a topology that shares state across the pair — the pre-existing gRPC hub
+        // (whose central-side store is the shared SQL-Server store, not per-node SQLite) or
+        // SQL-Server replication. No Secrets:Store:Provider is set at all here — the exact case
+        // that used to warn before this fix — and it must stay silent because the node is not
+        // actually on a per-node SQLite store in this configuration.
+        var values = ValidCentralConfig();
+        values["ScadaBridge:InboundApi:ApiKeyStore:Provider"] = "SqlServer";
+        values["Secrets:Replication:Enabled"] = "true";
+        var config = BuildConfig(values);
+
+        var warnings = StartupValidator.CollectWarnings(config);
+
+        Assert.Empty(warnings);
+    }
+
    [Fact]
    public void CollectWarnings_SilentForSingleSeedCentral()
    {