fix(review): full code-review remediation — 5 High + Medium/Low across 16 modules

Remediation from the full per-module code review at 4307c381 (findings recorded separately in code-reviews/). Highs fixed: - DeploymentManager-025/SiteRuntime-031: stop broadcasting notification lists + SMTP configs (incl. credentials) to sites; site purges already-persisted rows on apply (enforces the central-only delivery design; clears plaintext SMTP creds at rest). - DataConnectionLayer-023: guard the native-alarm subscribe path against the mid-flight-unsubscribe adapter-feed leak (mirrors the DCL-021 tag-path fix). - SiteEventLogging-024: normalize From/To query bounds to UTC (the -016 fix the audit trail claimed but never committed). - KpiHistory-001: add an in-flight guard to the recorder sample tick. - ScriptAnalysis-001: harden the trust analyzer's TPA-absent fallback (resolve forbidden anchors in the minimal reference set; warn on degraded mode) — anchors added to validation references only, never the compile gate. (InboundAPI-026 left to the feat/ipsen-movein effort per owner decision.) Medium/Low: DM-026 deterministic deploy-status tiebreaker; SR-027/028/029/030 native-alarm leak/phantom-active/delete-during-redeploy fixes; AL-013/014/016; TE-024 (folder-mutation audit rows now persisted)/025; SF-025 gauge-provider clear-on-stop; ESG-025/026; SEC-023/024/025; SCA-007/008/009; plus doc/test accuracy COM-023/024, HOST-025/026, HM-024/025, NS-027/028. Full-solution build 0 warnings; ~3560 tests across 18 touched suites green.
2026-06-20 17:55:12 -04:00
parent 4307c38117
commit fd618cf1dc
52 changed files with 2239 additions and 313 deletions
@@ -184,6 +184,62 @@ public class DeploymentManagerRedeployTests : TestKit, IDisposable
        Assert.True(disable.Success);
    }

+    [Fact]
+    public async Task SR029_DeleteDuringPendingRedeploy_InstanceStaysDeleted_AndCounterIsCorrect()
+    {
+        // Regression test for SiteRuntime-029. A delete arriving WHILE a redeploy is
+        // still terminating used to: (1) over-decrement _totalDeployedCount, and
+        // (2) leave the buffered _pendingRedeploys entry intact — so when Terminated
+        // fired, HandleTerminated called ApplyDeployment(isRedeploy: true) and
+        // RESURRECTED the just-deleted instance (re-creating the actor and re-writing
+        // the deployed-config SQLite row). After the fix, HandleDelete is authoritative
+        // over the mid-redeploy bookkeeping: it cancels the pending redeploy (telling
+        // the displaced deployer it was superseded), clears the terminating shadow, and
+        // decrements the counter exactly once.
+        var health = new CountCapturingHealthCollector();
+        var actor = CreateDeploymentManager(health);
+        await Task.Delay(500);
+
+        // Establish the running instance.
+        actor.Tell(new DeployInstanceCommand(
+            "dep-1", "RaceTarget", "h1", MakeConfigJson("RaceTarget"), "admin", DateTimeOffset.UtcNow));
+        var first = ExpectMsg<DeploymentStatusResponse>(TimeSpan.FromSeconds(5));
+        Assert.Equal(DeploymentStatus.Success, first.Status);
+        await Task.Delay(300);
+
+        // Fire a redeploy immediately followed by a delete. Both queue on the
+        // singleton mailbox: HandleDeploy runs first (removes from _instanceActors,
+        // watches + stops the predecessor, buffers the redeploy, sets the terminating
+        // shadow), then HandleDelete runs while the predecessor is still terminating
+        // (Terminated has not fired) — exactly the SiteRuntime-029 window.
+        var redeployProbe = CreateTestProbe();
+        actor.Tell(new DeployInstanceCommand(
+            "dep-2", "RaceTarget", "h2", MakeConfigJson("RaceTarget"), "admin", DateTimeOffset.UtcNow),
+            redeployProbe.Ref);
+        actor.Tell(new DeleteInstanceCommand("del-1", "RaceTarget", DateTimeOffset.UtcNow));
+
+        // The delete succeeds...
+        var delete = ExpectMsg<InstanceLifecycleResponse>(TimeSpan.FromSeconds(10));
+        Assert.True(delete.Success);
+
+        // ...and the displaced redeploy is told it was superseded (not silently lost).
+        var superseded = redeployProbe.ExpectMsg<DeploymentStatusResponse>(TimeSpan.FromSeconds(10));
+        Assert.Equal("dep-2", superseded.DeploymentId);
+        Assert.Equal(DeploymentStatus.Failed, superseded.Status);
+        Assert.Contains("superseded", superseded.ErrorMessage!, StringComparison.OrdinalIgnoreCase);
+
+        // Give the predecessor's Terminated signal time to fire — it must NOT
+        // resurrect the deleted instance.
+        await Task.Delay(1000);
+
+        // The instance stays deleted: no deployed-config row remains.
+        var configs = await _storage.GetAllDeployedConfigsAsync();
+        Assert.DoesNotContain(configs, c => c.InstanceUniqueName == "RaceTarget");
+
+        // The deployed count is back to 0 — neither over-decremented nor resurrected.
+        Assert.Equal(0, health.LastDeployedCount);
+    }
+
    [Fact]
    public async Task Redeploy_ExistingInstance_DoesNotOverCountDeployedInstances()
    {
@@ -9,6 +9,7 @@ using ZB.MOM.WW.ScadaBridge.Commons.Types.Enums;
 using ZB.MOM.WW.ScadaBridge.Commons.Types.Flattening;
 using ZB.MOM.WW.ScadaBridge.SiteRuntime;
 using ZB.MOM.WW.ScadaBridge.SiteRuntime.Actors;
+using ZB.MOM.WW.ScadaBridge.SiteRuntime.Messages;
 using ZB.MOM.WW.ScadaBridge.SiteRuntime.Persistence;
 using ZB.MOM.WW.ScadaBridge.SiteRuntime.Tests.TestSupport;

@@ -44,8 +45,12 @@ public class NativeAlarmActorTests : TestKit, IDisposable
            "Process", "hi", "hi", "", "", null, time ?? DateTimeOffset.UtcNow, "92", "90");

    private IActorRef Spawn(IActorRef instanceActor, IActorRef dclManager, IServiceProvider? serviceProvider = null) =>
+        Spawn(instanceActor, dclManager, _options, serviceProvider);
+
+    private IActorRef Spawn(IActorRef instanceActor, IActorRef dclManager, SiteRuntimeOptions options,
+        IServiceProvider? serviceProvider = null) =>
        ActorOf(Props.Create(() => new NativeAlarmActor(
-            Source(), "inst", instanceActor, dclManager, _storage, _options,
+            Source(), "inst", instanceActor, dclManager, _storage, options,
            NullLogger<NativeAlarmActor>.Instance, AlarmKind.NativeOpcUa, serviceProvider)));

    [Fact]
@@ -297,6 +302,74 @@ public class NativeAlarmActorTests : TestKit, IDisposable
        }, TimeSpan.FromSeconds(2));
    }

+    // ── SiteRuntime-028: cap eviction emits a return-to-normal for an active drop ──
+
+    [Fact]
+    public void EnforceCap_EvictsActiveOldestCondition_EmitsReturnToNormalAndDropSignal()
+    {
+        // SiteRuntime-028: a cap eviction that drops a still-Active condition without a
+        // return-to-normal leaves the Instance Actor (and central's stream / the
+        // operator Alarm Summary) showing a phantom Active alarm forever. With cap=1,
+        // raising a second condition evicts the oldest (still Active) one — which must
+        // produce a Normal AlarmStateChanged for the evicted SourceReference, plus the
+        // SiteRuntime-027 NativeAlarmDropped so the parent evicts its stale key.
+        var instance = CreateTestProbe();
+        var dcl = CreateTestProbe();
+        var options = new SiteRuntimeOptions { MirroredAlarmCapPerSource = 1 };
+        var actor = Spawn(instance.Ref, dcl.Ref, options);
+        dcl.ExpectMsg<SubscribeAlarmsRequest>();
+
+        var t0 = DateTimeOffset.UtcNow;
+        // Oldest active condition (will be evicted when the cap is exceeded).
+        actor.Tell(new NativeAlarmTransitionUpdate("Opc", Transition(
+            "OLD.Hi", AlarmTransitionKind.Raise,
+            new AlarmConditionState(true, false, null, AlarmShelveState.Unshelved, false, 800), t0)));
+        instance.ExpectMsg<AlarmStateChanged>(m => m.SourceReference == "OLD.Hi" && m.State == AlarmState.Active);
+
+        // Newer active condition pushes the set to 2 > cap(1) → OLD.Hi is evicted.
+        actor.Tell(new NativeAlarmTransitionUpdate("Opc", Transition(
+            "NEW.Hi", AlarmTransitionKind.Raise,
+            new AlarmConditionState(true, false, null, AlarmShelveState.Unshelved, false, 800), t0.AddSeconds(5))));
+
+        // The new condition is emitted active...
+        instance.ExpectMsg<AlarmStateChanged>(m => m.SourceReference == "NEW.Hi" && m.State == AlarmState.Active);
+        // ...and the evicted oldest condition must be cleared (return-to-normal), not
+        // left phantom-active.
+        instance.ExpectMsg<AlarmStateChanged>(m => m.SourceReference == "OLD.Hi" && m.State == AlarmState.Normal);
+        // ...and the parent is told to evict the stale _latestAlarmEvents key.
+        instance.ExpectMsg<NativeAlarmDropped>(m => m.SourceReference == "OLD.Hi");
+    }
+
+    // ── SiteRuntime-027: terminal retention drop signals the parent to evict its key ──
+
+    [Fact]
+    public void RetentionDrop_ResolvedCondition_EmitsReturnToNormalThenDropSignal()
+    {
+        // SiteRuntime-027: when a native condition resolves (inactive AND acknowledged)
+        // it drops out of the mirror. The Instance Actor must be told (NativeAlarmDropped)
+        // so its _latestAlarmEvents map does not retain a stale (Normal) entry forever —
+        // otherwise a source that mints a fresh SourceReference per occurrence leaks one
+        // entry per condition the instance has ever seen.
+        var instance = CreateTestProbe();
+        var dcl = CreateTestProbe();
+        var actor = Spawn(instance.Ref, dcl.Ref);
+        dcl.ExpectMsg<SubscribeAlarmsRequest>();
+
+        var t0 = DateTimeOffset.UtcNow;
+        actor.Tell(new NativeAlarmTransitionUpdate("Opc", Transition(
+            "T01.Hi", AlarmTransitionKind.Raise,
+            new AlarmConditionState(true, false, null, AlarmShelveState.Unshelved, false, 800), t0)));
+        instance.ExpectMsg<AlarmStateChanged>(m => m.State == AlarmState.Active);
+
+        // Resolved: inactive AND acknowledged → return-to-normal emitted, then dropped.
+        actor.Tell(new NativeAlarmTransitionUpdate("Opc", Transition(
+            "T01.Hi", AlarmTransitionKind.Clear,
+            new AlarmConditionState(false, true, null, AlarmShelveState.Unshelved, false, 0), t0.AddSeconds(5))));
+
+        instance.ExpectMsg<AlarmStateChanged>(m => m.SourceReference == "T01.Hi" && m.State == AlarmState.Normal);
+        instance.ExpectMsg<NativeAlarmDropped>(m => m.SourceReference == "T01.Hi");
+    }
+
    void IDisposable.Dispose()
    {
        Shutdown();