Joseph Doherty
9a87d7a328
Second slice of the 2026-09-09 whole-system review remediation
(docs/plans/2026-09-09-arch-review.md §10), on top of the High slice 146a1323.
Runtime/devices: SR-2 alarm on-trigger integration scope; SR-3 correlated NativeAlarmActor
subscribe retry; SR-4 immutable audited DB target; SR-5 ordered InstanceActor stop/flush;
SR-12 rehydration fence; SR-13 S&F gate recheck per delivery; DC-4 no OPC UA security
downgrade; DC-5 alarm snapshot for every new subscriber; ORCH-1 sync-dispose joins the pump.
Management/UI: MG-2 site scope on audit tree + Flow Debugger Replay; MG-3 stale-probe memo
removed; MG-4 server-owned bulk-deploy deadline; UI-5 sandbox runs in a killable child
process (new CentralUI.SandboxWorker project); UI-14 bounded sandbox output/IPC.
Edge/audit: EI-1 relay audit ownership; EI-2 SkipBodyCapture suppresses error text; EI-3/EI-11
error-field redaction + caps; EI-4 single relay deadline, pre-execution-only retry; EI-5
authenticated relay provenance; EI-10 body cap before audit read.
Persistence/contracts: DL-1 global Instance.UniqueName unique index + conflict translation;
DL-2 DataConnection protocol config encrypted at rest (migration
20260909203046_EnforceGlobalInstanceNamesAndProtectProtocolConfiguration — coordinated
central upgrade, old binaries cannot read protected rows); DL-3 bounded Replay paging;
DL-6 cross-site Overwrite of a deployed instance rejected; XC-4 proto descriptor contract test.
Config/hygiene: XC-1 central listener isolation by local port; XC-2/XC-3 inert SMTP + cron
keys removed from rig settings; CM-2 env2 bootstrap guard enabled; DC-6 deploy site exit code;
DC-7 notifier retries only explicit standby rejection; XC-5 ClusterClient purged from docs.
Gates recorded in the report: build 0/0, 9 397 passed / 0 failed, rig redeployed on all
eight nodes with the migration applied. 46 Low findings remain open.
78 lines
4.4 KiB
C#
78 lines
4.4 KiB
C#
using Microsoft.AspNetCore.DataProtection;
|
|
using Microsoft.Data.SqlClient;
|
|
using Microsoft.EntityFrameworkCore;
|
|
using Microsoft.EntityFrameworkCore.Migrations;
|
|
using Microsoft.EntityFrameworkCore.Migrations.Operations;
|
|
using ZB.MOM.WW.ScadaBridge.Commons.Entities.Instances;
|
|
using ZB.MOM.WW.ScadaBridge.Commons.Entities.Sites;
|
|
using ZB.MOM.WW.ScadaBridge.Commons.Entities.Templates;
|
|
using ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.Migrations;
|
|
|
|
namespace ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.Tests.Migrations;
|
|
|
|
public class MediumPersistenceSqlTests : IClassFixture<MsSqlMigrationFixture>
|
|
{
|
|
private readonly MsSqlMigrationFixture _fixture;
|
|
public MediumPersistenceSqlTests(MsSqlMigrationFixture fixture) => _fixture = fixture;
|
|
|
|
[SkippableFact]
|
|
public async Task RealSql_GlobalNameRaceAndLegacyCredentialUpgrade()
|
|
{
|
|
Skip.IfNot(_fixture.Available, _fixture.SkipReason);
|
|
var options = new DbContextOptionsBuilder<ScadaBridgeDbContext>().UseSqlServer(_fixture.ConnectionString).Options;
|
|
var protection = new EphemeralDataProtectionProvider();
|
|
await using var db = new ScadaBridgeDbContext(options, protection);
|
|
var a = new Site("Medium A", "medium-a"); var b = new Site("Medium B", "medium-b");
|
|
var template = new Template("Medium template");
|
|
db.AddRange(a, b, template);
|
|
await db.SaveChangesAsync();
|
|
async Task<bool> Insert(int site)
|
|
{
|
|
await using var attempt = new ScadaBridgeDbContext(options, protection);
|
|
attempt.Instances.Add(new Instance("global-medium-pump") { SiteId = site, TemplateId = template.Id });
|
|
try { await attempt.SaveChangesAsync(); return true; }
|
|
catch (InstanceNameConflictException) { return false; }
|
|
}
|
|
var race = await Task.WhenAll(Insert(a.Id), Insert(b.Id));
|
|
Assert.Single(race, success => success);
|
|
Assert.Single(race, success => !success);
|
|
await db.Database.ExecuteSqlRawAsync(
|
|
"INSERT INTO DataConnections (SiteId, Name, Protocol, PrimaryConfiguration, BackupConfiguration, FailoverRetryCount) VALUES ({0}, 'legacy-medium', 'OpcUa', {1}, {2}, 3)",
|
|
a.Id, """{"password":"sql-primary-secret"}""", """{"password":"sql-backup-secret"}""");
|
|
await DataConnectionSecretUpgrade.UpgradeAsync(db);
|
|
await DataConnectionSecretUpgrade.UpgradeAsync(db);
|
|
var protectedRow = await db.DataConnections.SingleAsync(c => c.Name == "legacy-medium");
|
|
Assert.Contains("sql-primary-secret", protectedRow.PrimaryConfiguration);
|
|
Assert.Contains("sql-backup-secret", protectedRow.BackupConfiguration);
|
|
|
|
using var connection = _fixture.OpenConnection();
|
|
using var raw = connection.CreateCommand();
|
|
raw.CommandText = "SELECT PrimaryConfiguration FROM DataConnections WHERE Name = 'legacy-medium'";
|
|
Assert.DoesNotContain("sql-primary-secret", (string)(await raw.ExecuteScalarAsync())!);
|
|
raw.CommandText = "SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME='DataConnections' AND COLUMN_NAME IN ('PrimaryConfiguration','BackupConfiguration') AND CHARACTER_MAXIMUM_LENGTH=-1";
|
|
Assert.Equal(2, (int)(await raw.ExecuteScalarAsync())!);
|
|
|
|
// A pre-upgrade conflict is rejected explicitly; the transaction restores the index.
|
|
using var transaction = connection.BeginTransaction();
|
|
using var legacy = connection.CreateCommand();
|
|
legacy.Transaction = transaction;
|
|
legacy.CommandText = "DROP INDEX IX_Instances_UniqueName ON Instances";
|
|
await legacy.ExecuteNonQueryAsync();
|
|
legacy.CommandText = "INSERT INTO Instances (UniqueName, TemplateId, SiteId, State) VALUES ('global-medium-pump', @template, @site, 'NotDeployed')";
|
|
legacy.Parameters.AddWithValue("@template", template.Id);
|
|
legacy.Parameters.AddWithValue("@site", a.Id);
|
|
await legacy.ExecuteNonQueryAsync();
|
|
var builder = new MigrationBuilder("Microsoft.EntityFrameworkCore.SqlServer");
|
|
new ProbeMigration().Apply(builder);
|
|
legacy.CommandText = builder.Operations.OfType<SqlOperation>().First().Sql;
|
|
var denied = await Assert.ThrowsAsync<SqlException>(() => legacy.ExecuteNonQueryAsync());
|
|
Assert.Equal(51002, denied.Number);
|
|
transaction.Rollback();
|
|
}
|
|
|
|
private sealed class ProbeMigration : EnforceGlobalInstanceNamesAndProtectProtocolConfiguration
|
|
{
|
|
public void Apply(MigrationBuilder builder) => base.Up(builder);
|
|
}
|
|
}
|