4921ebb0c8
fix(host): distinguish secret-store fault from missing PSK secret (review 2026-10-21 05/U2)
2026-10-22 09:00:49 -04:00
12f815a7ea
fix(esg): short-TTL definition cache for central lookups (review 2026-10-21 05/P2)
2026-10-22 09:00:49 -04:00
ee8be8001e
fix(esg): JSON-serialise non-scalar GET/DELETE query parameters (review 2026-10-21 05/O2)
2026-10-22 09:00:49 -04:00
e93af5a21f
fix(inbound): single-use nonce on relay provenance proofs (review 2026-10-21 05/O1)
2026-10-22 09:00:49 -04:00
26baa5a170
fix(inbound): in-memory request buffering; relaying standby skips audit capture (review 2026-10-21 05/M4)
2026-10-22 09:00:49 -04:00
6c9dfaf700
fix(inbound): prune expired ApiMethodCache entries; pin exact-name scopes (review 2026-10-21 05/M3)
2026-10-22 09:00:49 -04:00
d7e87c0688
fix(inbound): single-flight method compile so concurrent first callers share one assembly (review 2026-10-21 05/M1)
2026-10-22 09:00:49 -04:00
37c25db2f1
fix(site-runtime): batch native-alarm deletes into the coalesced flush transaction; docs for scripts/cache/scheduler (review 2026-10-21 01/SR-P2)
2026-10-22 09:00:49 -04:00
010d2ea438
fix(site-runtime): ConfigureAwait(false) on remaining script helper awaits (review 2026-10-21 01/SR-U2)
2026-10-22 09:00:49 -04:00
4ff26a0614
fix(site-runtime): rate-limit shed Warning logs per script/alarm (review 2026-10-21 01/SR-P6)
2026-10-22 09:00:48 -04:00
7541a38762
fix(site-runtime): reuse exited detached worker slots in script scheduler (review 2026-10-21 01/SR-M1)
2026-10-22 09:00:48 -04:00
96cab3f3d7
fix(site-runtime): compile cache eviction counter+warning, configurable bound, never cache faulted compiles (review 2026-10-21 01/SR-M2)
2026-10-22 09:00:48 -04:00
b0a08bb63b
fix(auditlog): explicit permanent rejections on the ingest ack (IngestAck.rejected_event_ids, field 2) with a dedicated counter; reconciler ignores transient faults for abandonment; persist the served high-water mark; prune only on a non-empty enumeration (review 2026-10-21 06/PERF-1, 06/IMPL-1 adversarial follow-up)
2026-10-22 09:00:48 -04:00
38167bca88
fix(auditlog): prune per-site reconciliation state and pull-channel caches for sites absent from the enumeration; bound the abandoned-id set (review 2026-10-21 06/MEM-2)
2026-10-22 09:00:48 -04:00
9e7e19c3c1
fix(auditlog): reconciliation pull serves only unacked rows (PushAbandoned/Rejected push-exit states), central pages within a tick with set-based inserts; refused push rows leave the queue after N attempts (review 2026-10-21 06/PERF-1, 06/COR-3, 06/IMPL-1)
2026-10-22 09:00:48 -04:00
1da5d0bac4
fix(auditlog): page the site audit purge, bound incremental_vacuum per page, fail fast instead of parking writers on a full queue (review 2026-10-21 06/MEM-1)
2026-10-22 09:00:48 -04:00
268b55e350
fix(auditlog): do not log a graceful-stop OperationCanceledException at Error in the telemetry drains (review 2026-10-21 06/COR-2)
2026-10-22 09:00:48 -04:00
15496575bc
fix(communication): release the _activeStreams slot when relay ActorOf throws (review 2026-10-21 03/M-2)
2026-10-22 09:00:48 -04:00
dd60e236bd
fix(communication): ReconcileSite threads the gRPC call's cancellation into central reconcile work (review 2026-10-21 03/P-1b)
2026-10-22 09:00:48 -04:00
429ccb8d90
fix(communication): failback probe sentinel uses an illegal actor name so it can never match a real instance (review 2026-10-21 03/P-2 follow-up)
2026-10-22 09:00:48 -04:00
82976b7377
fix(communication): streaming endpoint lookups are generation-fenced and cannot strand their in-flight guards (review 2026-10-21 03/R-2 follow-up)
2026-10-22 09:00:48 -04:00
e0ebebac11
fix(communication): site-address load guard cannot wedge on an unexpected fault; lifecycle-cancelled loads log at Debug (review 2026-10-21 03/M-1 follow-up)
2026-10-22 09:00:48 -04:00
4456a04e81
fix(communication): failback probation is time-boxed and cleared on address change (review 2026-10-21 03/P-2 follow-up)
2026-10-22 09:00:48 -04:00
f4d328aecc
fix(communication): alarm aggregator reconcile tick does not reopen while a backoff reconnect is pending (double subscribe; surfaced by review 2026-10-21 03/R-2 work)
2026-10-22 09:00:48 -04:00
c5add11546
fix(communication): command-plane failback probes readiness with a real RPC; backoff resets only after a real call succeeds (review 2026-10-21 03/P-2)
2026-10-22 09:00:48 -04:00
017308a397
fix(communication): DebugStreamService drops the session on an InstanceNotFound snapshot (review 2026-10-21 03/M-3)
2026-10-22 09:00:48 -04:00
90306f0ccb
fix(communication): streaming consumers re-resolve site gRPC addresses on every reopen; spec matches (review 2026-10-21 03/R-2, 03/D-2)
2026-10-22 09:00:48 -04:00
3ed71167b3
fix(communication): site-address refresh gets an overlap guard, per-load deadline and monotonic sequence (review 2026-10-21 03/M-1)
2026-10-22 09:00:48 -04:00
b0a97a4b67
fix(communication): malformed site gRPC address keeps the old channel, never aborts the refresh tick or restarts CentralCommunicationActor (review 2026-10-21 03/R-1)
2026-10-22 09:00:48 -04:00
0fd9bcbce6
fix(communication): delete dead SiteAddressCacheLoaded.SiteContacts + legacy NodeA/B parse (review 2026-10-21 03/D-1)
2026-10-22 09:00:48 -04:00
004f3bd155
fix(configdb): delete dead repository members; completes 08/P8 for owned files (review 2026-10-21 08/P8; CentralUi members and tests went in the preceding P5 commit)
2026-10-22 08:33:09 -04:00
c6e4c7820a
fix(configdb): InstanceLocator single untracked projected join (review 2026-10-21 08/P7)
2026-10-22 08:33:09 -04:00
1d00d5f469
fix(configdb): deterministic config-audit paging (review 2026-10-21 08/P5)
2026-10-22 08:33:09 -04:00
036f341a9d
fix(configdb): opt-in config-audit retention purge + after-state size cap (review 2026-10-21 08/G1)
2026-10-22 08:33:09 -04:00
394234b450
fix(dcl): advance the session generation when a reconnect attempt is issued, not when its result is applied (review 2026-10-21 02/C1 follow-up)
2026-10-22 08:33:00 -04:00
d8d44e0b87
perf(dcl): coalesce MxGateway alarm stream reopens across a subscribe burst (review 2026-10-21 02/P3)
2026-10-22 08:33:00 -04:00
e6406c494c
fix(dcl): async OPC UA endpoint discovery bounded by OperationTimeoutMs/verify budget; adapter connect never runs on the actor thread (review 2026-10-21 02/P2)
2026-10-22 08:33:00 -04:00
cfe95a7e5a
fix(dcl): log the initial connect to Site Event Logging like every other transition (review 2026-10-21 02/U4)
2026-10-22 08:33:00 -04:00
3543a7f295
fix(dcl): feed ScadaBridge:MxGateway:ClientNamePrefix into the MxGateway client-name fallback (review 2026-10-21 02/U1, 08/O2)
2026-10-22 08:33:00 -04:00
f18d3adbfc
fix(dcl): forget an OPC UA condition's last state once it returns to normal (review 2026-10-21 02/L3)
2026-10-22 08:33:00 -04:00
d51ea5136a
fix(dcl): drop values for unsubscribed tags before quality bookkeeping; cancel the reconnect re-seed when its session ends (review 2026-10-21 02/L2, 02/L4)
2026-10-22 08:33:00 -04:00
8c1bd2c3fc
fix(dcl): advance the session generation on same-adapter reconnect and session-scope MxGateway subscription ids (review 2026-10-21 02/C1, 02/L1)
2026-10-22 08:33:00 -04:00
b811a2451b
fix(dcl): remove unused poll-based WriteBatchAndWaitAsync from IDataConnection and both adapters (review 2026-10-21 02/U3)
2026-10-22 08:33:00 -04:00
3169429c3f
fix(site-event-log): queries on own read connection off the actor thread, bounded keyword window; cap trim counts/vacuums rarely (review 2026-10-21 02/P1, 02/P4)
2026-10-22 08:32:37 -04:00
f7c4adbaed
docs(store-and-forward): replication text is LocalDb CDC; document lane paging + gauge reseed (review 2026-10-21 02/U4a)
2026-10-22 08:32:37 -04:00
d3cba15699
fix(store-and-forward): re-seed queue-depth gauge from DB on sweep, clamp at 0 (review 2026-10-21 02/C3)
2026-10-22 08:32:37 -04:00
76f7960a06
fix(store-and-forward): page retry sweep per (category,target) lane; drop dead GetAllMessagesAsync (review 2026-10-21 02/C2, 02/U2)
2026-10-22 08:32:37 -04:00
e968566e9d
fix(cli): no redirects on the management client, race-safe token refresh, verbose Basic-fallback note (review 2026-10-21 05/U1, 05/P1 L1/L2/L3/L4)
...
- CreateDefaultHttpClient sets AllowAutoRedirect=false so a 307/308 cannot re-POST the
/auth/token credential form elsewhere.
- A forced re-exchange after a 401 carries the refused token; inside the gate it reuses
a token another caller already re-exchanged instead of binding again. The BasicOnly
switch is written under the same gate.
- SCADABRIDGE_VERBOSE=1 prints a stderr note when a fresh token is refused and the CLI
falls back to Basic.
- debug stream's AccessTokenProvider retries the exchange once and documents the
null-token degradation (the hub refuses, automatic reconnect retries).
- Tests: concurrent refusal reuses the peer refresh (2 exchanges, not 3); real-socket
redirect is not followed.
2026-10-22 08:25:35 -04:00
ea172edebc
fix(security): bearer token hardening follow-ups — nbf skew, TTL-0 path, cache docs, extra rejection tests (review 2026-10-21 05/U1, 05/P1 L1/L5/L6)
...
- JwtTokenService back-dates nbf by the 30 s validation skew so a peer central whose
clock lags the issuer accepts a fresh token after failover.
- RoleMappingCacheSeconds = 0 routes RoleMapper to the matched-rows loader (old cost)
instead of loading every Deployer mapping's scope rules per call.
- RoleMappingCache / SecurityOptions / Component-Security.md describe Invalidate() by
its contract plus the TTL, not by a call site.
- Tests: HS512 with the same key, issuer/audience mismatch, lagging-peer nbf, TTL-0
matched-only reads, refresh-vs-Invalidate generation race.
2026-10-22 08:25:35 -04:00
1b3928a0a2
fix(security): finish the bearer-token design and cache role mappings (review 2026-10-21 05/U1, 05/P1)
...
- ManagementAuthenticator accepts Authorization: Bearer <jwt> alongside Basic on
/management, the audit REST endpoints and the debug-stream hub. Tokens are
validated locally (HS256 only, alg=none rejected, issuer/audience, lifetime with
30 s skew); roles and site scope inside a valid token are authoritative for its
lifetime, so a bearer call costs no LDAP bind and no role re-map.
- /auth/token returns expires_in + management_bearer:true, carries username, display
name, roles and permitted sites, and answers 404 under DisableLogin.
- CLI exchanges credentials once per process (in-memory CliTokenStore), sends Bearer,
re-exchanges once on 401 then falls back to Basic; older/login-disabled servers are
Basic-only; bad credentials are not retried with Basic. Debug stream uses the token
via AccessTokenProvider. SCADABRIDGE_AUTH_MODE=basic opts out.
- StartupValidator fails a Central boot on a JwtSigningKey under 32 UTF-8 bytes;
fixed the false 'fail-fast at construction' comment. Removed the dead
RefreshToken/RecordActivity/ShouldRefresh/IsIdleTimedOut members and the inert
JwtRefreshThresholdMinutes; JwtExpiryMinutes now documented as the bearer lifetime
(validated > 0).
- RoleMapper reads through a process-wide RoleMappingCache (RoleMappingCacheSeconds,
default 30 s): one refresh loads the table plus every Deployer mapping's scope
rules, Invalidate() drops it (generation-guarded against in-flight refreshes).
- Component-Security.md / Component-CLI.md / CLI README describe the real model
(cookie claims ticket, bearer for CLI) instead of a cookie-embedded JWT.
2026-10-22 08:25:35 -04:00
Joseph Doherty