feat(management): parquet audit export and audit archive list/verify (ScadaBridge#42)

GET /api/audit/export?format=parquet returned 501. It now streams the same 24
columns as csv/jsonl (AuditExportRow, CsvHeader order) as one Parquet file,
one 10,000-row row group at a time. Each row group is encoded into a small
non-seekable staging buffer and copied to the response asynchronously, because
Kestrel rejects the synchronous writes the Parquet writer issues.

New management commands, with CLI parity:
- ListAuditArchives -> `audit archive list` (AuditArchiveListResult: enabled
  flag + every manifest).
- VerifyAuditArchive(Name) -> `audit archive verify --name` (files, chain,
  purge anchor); exit 0 verified, 3 not verified, 1 error, 2 unauthorized.
Both carry verify-chain's gate: OperationalAudit roles (Administrator, Viewer),
site-scoped non-Administrator refused because an archive spans every site.
VerifyAuditArchive uses the long-running Ask timeout. Error codes
ARCHIVE_NOT_CONFIGURED, INVALID_ARGUMENT, NOT_FOUND.

RequiredRoleMatrixTests freezes both gates; ManagementSurfaceParityTests now
probes `audit archive list|verify` alongside `audit verify-chain`.

Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV

This commit is contained in:

Joseph Doherty

2026-11-09 17:00:58 -05:00

parent 7be4f19861

commit d1fc336e18

17 changed files with 982 additions and 42 deletions

									
										src/ZB.MOM.WW.ScadaBridge.ManagementService/ZB.MOM.WW.ScadaBridge.ManagementService.csproj
									
		+1
		
												View File
												
				@@ -12,6 +12,7 @@

				    <InternalsVisibleTo Include="ZB.MOM.WW.ScadaBridge.ManagementService.Tests" />

				  </ItemGroup>

				  <ItemGroup>

				    <PackageReference Include="Parquet.Net" />

				    <PackageReference Include="Akka" />

				    <PackageReference Include="Akka.Cluster.Tools" />

				    <PackageReference Include="ZB.MOM.WW.Configuration" />