fix(management): Flow Debugger Live result is the redacted, capped trace copy (arch-review F1, central half)

RunMethodAsync collected sink events into a plain ConcurrentQueue and always reported Truncated: false, so the Live result carried RAW audit events — the per-target SQL-parameter overrides, header scrubbing and 8 KB / 64 KB payload caps that Replay reads back never applied to what the operator saw, and the reply had no upper bound at all. It now collects through the same FlowTraceCollector the site launcher uses, constructed with the host's IAuditRedactor (AddAuditLog's singleton; a host without one collects raw but is still capped by count and bytes), and reports Truncated from the collector. Complete() is called as soon as the run returns, so a late un-awaited call cannot mutate the snapshot the reply is built from. Claude-Session: https://claude.ai/code/session_01NcMG6xXdsJbmD2wYAgkK29
2026-09-06 14:21:07 -04:00
parent 05b97b596d
commit def6bab318
2 changed files with 72 additions and 4 deletions
@@ -331,4 +331,62 @@ public class FlowDebugRunnerTests
        Assert.NotNull(actual);
        Assert.Equal(new[] { "Administrator", "Deployer", "Viewer" }, actual!.OrderBy(r => r, StringComparer.Ordinal));
    }
+
+    // --- Arch-review F1: the Live result is the REDACTED, capped trace copy ---
+    //
+    // The runner collects sink events through the same FlowTraceCollector the site launcher
+    // uses, so central and site filter identically and a Live run shows exactly the rows a
+    // later Replay reads back out of the audit store.
+
+    /// <summary>Wires a method whose handler pushes <paramref name="events"/> straight at the trace sink.</summary>
+    private void WireSinkPushingMethod(int methodId, IEnumerable<AuditEvent> events)
+    {
+        var method = new ApiMethod("M", "x") { Id = methodId, TimeoutSeconds = 5 };
+        _apiRepo.GetApiMethodByIdAsync(methodId, Arg.Any<CancellationToken>()).Returns(method);
+        _executor.RegisterHandler("M", ctx =>
+        {
+            foreach (var e in events) ctx.Route.TraceSink!(e);
+            return Task.FromResult<object?>(null);
+        });
+    }
+
+    private static AuditEvent TraceRow(string? detailsJson) =>
+        ScadaBridgeAuditEventFactory.Create(
+            AuditChannel.ScriptTrace, AuditKind.ScriptRun, AuditStatus.Delivered,
+            executionId: Guid.NewGuid(), target: "work") with
+        { DetailsJson = detailsJson };
+
+    [Fact]
+    public async Task RunMethod_SinkEvents_AreRedacted_WhenARedactorIsRegistered()
+    {
+        WireSinkPushingMethod(31, [TraceRow("{\"secret\":\"abc\"}")]);
+        _services.AddSingleton<IAuditRedactor>(new UpperRedactor());
+
+        var result = await Runner().RunMethodAsync(_services.BuildServiceProvider(),
+            new FlowDebugRunMethodCommand(31, null), Deployer, CancellationToken.None);
+
+        Assert.True(result.Completed, result.Error);
+        Assert.Equal(2, result.Events.Count); // inbound row + the one sink event
+        Assert.Equal("{\"SECRET\":\"ABC\"}", result.Events[1].DetailsJson);
+        Assert.False(result.Truncated);
+    }
+
+    [Fact]
+    public async Task RunMethod_OverCap_ReportsTruncated()
+    {
+        WireSinkPushingMethod(32, Enumerable.Range(0, 501).Select(_ => TraceRow("{}")).ToList());
+
+        var result = await Runner().RunMethodAsync(_services.BuildServiceProvider(),
+            new FlowDebugRunMethodCommand(32, null), Deployer, CancellationToken.None);
+
+        Assert.True(result.Truncated);
+        Assert.Equal(501, result.Events.Count); // inbound row + the 500 kept
+    }
+
+    /// <summary>Upper-cases <c>DetailsJson</c> so a test can see the filtered copy land.</summary>
+    private sealed class UpperRedactor : IAuditRedactor
+    {
+        public AuditEvent Apply(AuditEvent rawEvent)
+            => rawEvent with { DetailsJson = rawEvent.DetailsJson?.ToUpperInvariant() };
+    }
 }