Files

T

Joseph Doherty ac29599406 docs(plans): Flow Debugger architectural/code review — 4 Medium + 9 Low findings, test evidence

Full review of the Flow Debugger commit range (v1.0, v1.1 outbound calls, v1.2 follow-ups,
outcome-merge fix, two perf commits). Also records the exact 11 role-negative Playwright
tests that cannot pass on the login-disabled rig in the cluster-ops skill.

Claude-Session: https://claude.ai/code/session_01NcMG6xXdsJbmD2wYAgkK29

2026-09-06 14:01:57 -04:00

2.5 KiB

Raw Blame History

name, description

name	description
scadabridge-cluster-ops	How to drive the local ScadaBridge docker cluster — CLI management URL and credentials, config file, rebuild/redeploy commands, and the infra services. Use when running CLI commands against the cluster, rebuilding after server-side changes, or starting the local test infrastructure.

ScadaBridge Cluster Ops (Docker / OrbStack)

Management URL: http://localhost:9000 — the CLI connects via the Traefik load balancer, which routes to the active central node. Direct access: central-a on port 9001, central-b on port 9002.
Central UI login is DISABLED on the rig (both central nodes, since 2026-09-06) — ScadaBridge:Security:Auth:DisableLogin=true in docker/central-node-{a,b}/appsettings.Central.json, so http://localhost:9000 (and 9001/9002) opens the UI as multi-role with every role, no LDAP login. The CLI/management API still takes --username/--password (Basic auth is a separate path), and POST /auth/login still answers 302, so the Playwright fixture login keeps working. Expected Playwright failures on this rig are exactly the 11 role-NEGATIVE tests (full run 2026-09-06: 164/175) — RoleNavigationTests.*_DoesNotSee*, AuditLogPageTests.PermissionGating_DesignerWithoutOperationalAudit_IsDeniedAccess, LoginTests.UnauthenticatedUser_RedirectsToLogin — because every browser session carries every role; any other Playwright failure is real. Flip the two keys back to false and recreate the node for real-login checks.
Test user: --username multi-role --password password — has Admin, Design, and Deployment roles. The admin user only has the Admin role and cannot create templates, data connections, or deploy.
Config file: ~/.scadabridge/config.json — stores managementUrl and default format. See docker/README.md for a ready-to-use test config.
Rebuild cluster: bash docker/deploy.sh — builds the scadabridge:latest image and recreates all containers. Run this after code changes to ManagementActor, Host, or any server-side component.
Infrastructure services: cd infra && docker compose up -d — starts MS SQL, OPC UA, SMTP, and REST API. These are separate from the cluster containers in docker/. LDAP is NOT started here — it is the shared GLAuth on 10.100.0.35:3893 (dc=zb,dc=local); source of truth and config: scadaproj/infra/glauth/.
All test LDAP passwords: password (see scadaproj/infra/glauth/config.toml for users and groups; canonical cross-app login: multi-role).

2.5 KiB Raw Blame History

ScadaBridge Cluster Ops (Docker / OrbStack)

2.5 KiB

Raw Blame History