Joseph Doherty
0289d51137
A DeployedSecretsMirror failure on the STANDBY node (e.g. a master-key mismatch
that stops a deployed secret decrypting there) was only logged on that node:
site health reports are sent by the active node only, so central never saw it.
- New 12th LocalDb-replicated table secret_mirror_status (node_name PK,
failures_json of {SecretName, Message}, checked_at; no FKs). Each node's
mirror writes only its own row, and only when its failure set changes plus
once per start-up (every write replicates via CDC). Best-effort: a failed
write is a Warning and is retried next pass. Node key = INodeIdentityProvider
NodeName, falling back to the machine name.
- SecretMirrorStatusReporter (SiteRuntime, every node, 30 s) reads every row
into ISiteHealthCollector.SetSecretMirrorStatuses -> additive nullable
SiteHealthReport.SecretMirrorStatuses (null = no data).
- Wire: SiteHealthReportDto.secret_mirror_statuses = 33 (presence wrapper so
null != empty); vendored CentralControl.cs regenerated; mapper both ways.
- Central UI Health card: 'Secret mirror failing' badge + compact per-node
node / secret / message list.
- Tests: mirror status write-on-change/first-pass/failure isolation, storage
round-trip, reporter/collector, DTO mapper round-trip incl. null/empty,
bUnit, replicated-table set (twelve) + FK guard wording.
231 lines
12 KiB
C#
231 lines
12 KiB
C#
using Microsoft.Data.Sqlite;
|
|
|
|
namespace ZB.MOM.WW.ScadaBridge.SiteRuntime.Persistence;
|
|
|
|
/// <summary>
|
|
/// DDL for the site's twelve configuration tables (nine original plus
|
|
/// <c>deployed_secrets</c>, <c>mirrored_secrets</c> and <c>secret_mirror_status</c>), extracted from
|
|
/// <see cref="SiteStorageService"/> so it can be applied by whoever owns the database
|
|
/// file.
|
|
/// <para>
|
|
/// Deliberately depends only on <c>Microsoft.Data.Sqlite</c>, not on the LocalDb library.
|
|
/// The Host applies this DDL to a LocalDb-managed connection before
|
|
/// <c>RegisterReplicated</c> installs the capture triggers; nothing about the schema
|
|
/// itself is LocalDb-specific, and the service still calls it so a directly-constructed
|
|
/// service (tests, tooling) remains self-sufficient.
|
|
/// </para>
|
|
/// <para>
|
|
/// Journal-mode and other connection pragmas are deliberately NOT set here — LocalDb owns
|
|
/// the connection's pragmas, and <see cref="SiteStorageService"/> keeps its own WAL set-up
|
|
/// for the databases it opens itself.
|
|
/// </para>
|
|
/// </summary>
|
|
public static class SiteStorageSchema
|
|
{
|
|
/// <summary>
|
|
/// Creates the twelve site configuration tables when absent, and additively upgrades
|
|
/// tables created by an older build. Idempotent — safe to run on every startup.
|
|
/// </summary>
|
|
/// <param name="connection">An open connection to the database that should hold the tables.</param>
|
|
public static void Apply(SqliteConnection connection)
|
|
{
|
|
ArgumentNullException.ThrowIfNull(connection);
|
|
|
|
using (var command = connection.CreateCommand())
|
|
{
|
|
command.CommandText = @"
|
|
CREATE TABLE IF NOT EXISTS deployed_configurations (
|
|
instance_unique_name TEXT PRIMARY KEY,
|
|
config_json TEXT NOT NULL,
|
|
deployment_id TEXT NOT NULL,
|
|
revision_hash TEXT NOT NULL,
|
|
is_enabled INTEGER NOT NULL DEFAULT 1,
|
|
deployed_at TEXT NOT NULL
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS static_attribute_overrides (
|
|
instance_unique_name TEXT NOT NULL,
|
|
attribute_name TEXT NOT NULL,
|
|
override_value TEXT NOT NULL,
|
|
updated_at TEXT NOT NULL,
|
|
PRIMARY KEY (instance_unique_name, attribute_name)
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS shared_scripts (
|
|
name TEXT PRIMARY KEY,
|
|
code TEXT NOT NULL,
|
|
parameter_definitions TEXT,
|
|
return_definition TEXT,
|
|
updated_at TEXT NOT NULL
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS external_systems (
|
|
name TEXT PRIMARY KEY,
|
|
endpoint_url TEXT NOT NULL,
|
|
auth_type TEXT NOT NULL,
|
|
auth_configuration TEXT,
|
|
method_definitions TEXT,
|
|
updated_at TEXT NOT NULL
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS database_connections (
|
|
name TEXT PRIMARY KEY,
|
|
connection_string TEXT NOT NULL,
|
|
max_retries INTEGER NOT NULL DEFAULT 3,
|
|
retry_delay_ms INTEGER NOT NULL DEFAULT 1000,
|
|
updated_at TEXT NOT NULL
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS notification_lists (
|
|
name TEXT PRIMARY KEY,
|
|
recipient_emails TEXT NOT NULL,
|
|
updated_at TEXT NOT NULL
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS data_connection_definitions (
|
|
name TEXT PRIMARY KEY,
|
|
protocol TEXT NOT NULL,
|
|
configuration TEXT,
|
|
backup_configuration TEXT,
|
|
failover_retry_count INTEGER NOT NULL DEFAULT 3,
|
|
updated_at TEXT NOT NULL
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS smtp_configurations (
|
|
name TEXT PRIMARY KEY,
|
|
server TEXT NOT NULL,
|
|
port INTEGER NOT NULL,
|
|
auth_mode TEXT NOT NULL,
|
|
from_address TEXT NOT NULL,
|
|
username TEXT,
|
|
password TEXT,
|
|
oauth_config TEXT,
|
|
updated_at TEXT NOT NULL
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS native_alarm_state (
|
|
instance_unique_name TEXT NOT NULL,
|
|
source_canonical_name TEXT NOT NULL,
|
|
source_reference TEXT NOT NULL,
|
|
condition_json TEXT NOT NULL,
|
|
last_transition_at TEXT NOT NULL,
|
|
metadata_json TEXT,
|
|
PRIMARY KEY (instance_unique_name, source_canonical_name, source_reference)
|
|
);
|
|
|
|
-- Deployed secrets (ciphertext only — see SecretArtifact). Replicated between the
|
|
-- two site nodes by LocalDb CDC (SiteLocalDbSetup.ReplicatedTables). A full-set
|
|
-- upsert soft-deletes rows absent from the incoming set via is_removed, never a
|
|
-- mass DELETE on a replicated table (that would ship as a destructive resync).
|
|
CREATE TABLE IF NOT EXISTS deployed_secrets (
|
|
name TEXT PRIMARY KEY,
|
|
row_json TEXT NOT NULL,
|
|
revision INTEGER NOT NULL,
|
|
updated_utc TEXT NOT NULL,
|
|
is_removed INTEGER NOT NULL DEFAULT 0,
|
|
deployment_id TEXT NOT NULL,
|
|
applied_at TEXT NOT NULL
|
|
);
|
|
|
|
-- Node-local ledger of which secret names THIS node has mirrored into its own
|
|
-- secret store. Deliberately NOT in SiteLocalDbSetup.ReplicatedTables: mirroring
|
|
-- is a per-node action against a per-node secret store, so which names are
|
|
-- mirrored (and at what revision) is node-specific, not site-wide state.
|
|
CREATE TABLE IF NOT EXISTS mirrored_secrets (
|
|
name TEXT PRIMARY KEY,
|
|
revision INTEGER NOT NULL,
|
|
mirrored_at TEXT NOT NULL
|
|
);
|
|
|
|
-- Per-node deployed-secrets mirror status (review finding M1): one row per site
|
|
-- node, keyed by node name, holding that node's CURRENT mirror failures as a JSON
|
|
-- array of {SecretName, Message} (names and messages only — never values or
|
|
-- ciphertext). Unlike mirrored_secrets this IS replicated
|
|
-- (SiteLocalDbSetup.ReplicatedTables): each node writes only its own row, and the
|
|
-- replication is exactly what lets the ACTIVE node's health report carry the
|
|
-- STANDBY node's failures to central. Written only when a node's failure set
|
|
-- changes (plus once per start-up), never per mirror tick. No foreign keys.
|
|
CREATE TABLE IF NOT EXISTS secret_mirror_status (
|
|
node_name TEXT PRIMARY KEY,
|
|
failures_json TEXT NOT NULL,
|
|
checked_at TEXT NOT NULL
|
|
);
|
|
";
|
|
command.ExecuteNonQuery();
|
|
}
|
|
|
|
// Schema migrations — add columns that may not exist on older databases
|
|
MigrateSchema(connection);
|
|
}
|
|
|
|
private static void MigrateSchema(SqliteConnection connection)
|
|
{
|
|
// Add backup_configuration and failover_retry_count to data_connection_definitions
|
|
// (added in primary/backup data connections feature)
|
|
AddColumnIfMissing(connection, "data_connection_definitions", "backup_configuration", "TEXT");
|
|
AddColumnIfMissing(connection, "data_connection_definitions", "failover_retry_count", "INTEGER NOT NULL DEFAULT 3");
|
|
|
|
// Native-alarm display metadata (UA4) — restored on rehydration so a persisted condition
|
|
// renders fully (type/category/message/values) before the first source snapshot arrives.
|
|
AddColumnIfMissing(connection, "native_alarm_state", "metadata_json", "TEXT");
|
|
|
|
// Per-external-system call timeout (ExternalSystemGateway Timeout) — carried through the
|
|
// artifact pipeline so site-side calls honor it; 0 = use the site default.
|
|
AddColumnIfMissing(connection, "external_systems", "timeout_seconds", "INTEGER NOT NULL DEFAULT 0");
|
|
|
|
// Store-and-Forward retry policy, deployed per external system (deferred-work row 27).
|
|
//
|
|
// 0 = unset on BOTH columns, which is what makes this additive change behaviourally
|
|
// invisible until an operator actually configures a policy: an existing row backfilled
|
|
// with the DEFAULT reads back as 0, and ExternalSystemClient.CachedCallAsync maps a 0
|
|
// to null so the engine's DefaultMaxRetries/DefaultRetryInterval still apply. (Contrast
|
|
// database_connections, whose equivalent columns default to 3/1000 — that table has
|
|
// never had an "unset means engine default" contract.)
|
|
//
|
|
// These land on a table in SiteLocalDbSetup.ReplicatedTables. That is safe and needs no
|
|
// trigger migration: RegisterReplicated re-reads PRAGMA table_info on EVERY boot and its
|
|
// install script is DROP-then-CREATE, so the capture triggers are rebuilt over the new
|
|
// column set automatically — and Apply() runs before RegisterReplicated, so the rebuild
|
|
// sees these columns on the same boot that adds them. What DOES change is the table's
|
|
// schema digest (ReplicatedTable.ComputeDigest hashes every column name + type), which
|
|
// the sync handshake compares fail-closed; a pair running mismatched builds refuses to
|
|
// sync loudly (LocalDbSchemaMismatchException) rather than corrupting anything. Both
|
|
// nodes must therefore be upgraded together — already the standing rule for a site pair
|
|
// (docs/deployment/topology-guide.md), so this introduces no new operational constraint.
|
|
AddColumnIfMissing(connection, "external_systems", "max_retries", "INTEGER NOT NULL DEFAULT 0");
|
|
AddColumnIfMissing(connection, "external_systems", "retry_delay_ms", "INTEGER NOT NULL DEFAULT 0");
|
|
}
|
|
|
|
/// <summary>
|
|
/// Additively adds a column only when it is not already present. SQLite lacks
|
|
/// <c>ADD COLUMN IF NOT EXISTS</c>, so the schema is probed via
|
|
/// <c>PRAGMA table_info</c> first. Mirrors <c>OperationTrackingSchema</c>.
|
|
/// <para>
|
|
/// This replaces the previous try/catch on <c>SqliteException</c> message text
|
|
/// containing "duplicate column": probing is the same precedent the other schema
|
|
/// classes use, does not depend on an error string that is not part of SQLite's
|
|
/// contract, and does not swallow unrelated failures of the same exception type.
|
|
/// </para>
|
|
/// </summary>
|
|
private static void AddColumnIfMissing(
|
|
SqliteConnection connection, string table, string columnName, string columnDefinition)
|
|
{
|
|
using (var probe = connection.CreateCommand())
|
|
{
|
|
// Table + column names are caller-controlled constants, never user input —
|
|
// safe to interpolate (parameters are not permitted in DDL or in a
|
|
// pragma-function argument).
|
|
probe.CommandText = $"SELECT COUNT(*) FROM pragma_table_info('{table}') WHERE name = $name";
|
|
probe.Parameters.AddWithValue("$name", columnName);
|
|
if (Convert.ToInt32(probe.ExecuteScalar()) > 0)
|
|
{
|
|
return;
|
|
}
|
|
}
|
|
|
|
using var alter = connection.CreateCommand();
|
|
alter.CommandText = $"ALTER TABLE {table} ADD COLUMN {columnName} {columnDefinition}";
|
|
alter.ExecuteNonQuery();
|
|
}
|
|
}
|