Joseph Doherty
9a87d7a328
Second slice of the 2026-09-09 whole-system review remediation
(docs/plans/2026-09-09-arch-review.md §10), on top of the High slice 146a1323.
Runtime/devices: SR-2 alarm on-trigger integration scope; SR-3 correlated NativeAlarmActor
subscribe retry; SR-4 immutable audited DB target; SR-5 ordered InstanceActor stop/flush;
SR-12 rehydration fence; SR-13 S&F gate recheck per delivery; DC-4 no OPC UA security
downgrade; DC-5 alarm snapshot for every new subscriber; ORCH-1 sync-dispose joins the pump.
Management/UI: MG-2 site scope on audit tree + Flow Debugger Replay; MG-3 stale-probe memo
removed; MG-4 server-owned bulk-deploy deadline; UI-5 sandbox runs in a killable child
process (new CentralUI.SandboxWorker project); UI-14 bounded sandbox output/IPC.
Edge/audit: EI-1 relay audit ownership; EI-2 SkipBodyCapture suppresses error text; EI-3/EI-11
error-field redaction + caps; EI-4 single relay deadline, pre-execution-only retry; EI-5
authenticated relay provenance; EI-10 body cap before audit read.
Persistence/contracts: DL-1 global Instance.UniqueName unique index + conflict translation;
DL-2 DataConnection protocol config encrypted at rest (migration
20260909203046_EnforceGlobalInstanceNamesAndProtectProtocolConfiguration — coordinated
central upgrade, old binaries cannot read protected rows); DL-3 bounded Replay paging;
DL-6 cross-site Overwrite of a deployed instance rejected; XC-4 proto descriptor contract test.
Config/hygiene: XC-1 central listener isolation by local port; XC-2/XC-3 inert SMTP + cron
keys removed from rig settings; CM-2 env2 bootstrap guard enabled; DC-6 deploy site exit code;
DC-7 notifier retries only explicit standby rejection; XC-5 ClusterClient purged from docs.
Gates recorded in the report: build 0/0, 9 397 passed / 0 failed, rig redeployed on all
eight nodes with the migration applied. 46 Low findings remain open.
68 lines
3.2 KiB
C#
68 lines
3.2 KiB
C#
using Microsoft.Data.Sqlite;
|
|
using Microsoft.Extensions.Logging.Abstractions;
|
|
using Moq;
|
|
using ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Services;
|
|
using ZB.MOM.WW.ScadaBridge.SiteRuntime.Scripts;
|
|
|
|
namespace ZB.MOM.WW.ScadaBridge.SiteRuntime.Tests.Scripts;
|
|
|
|
public class AuditingDbTransactionTests
|
|
{
|
|
[Theory]
|
|
[InlineData(false)]
|
|
[InlineData(true)]
|
|
public async Task SR11_TransactionConnectionAndCommandReadbackRemainAudited(bool asynchronous)
|
|
{
|
|
var inner = new SqliteConnection("Data Source=:memory:");
|
|
await inner.OpenAsync();
|
|
using (var seed = inner.CreateCommand())
|
|
{
|
|
seed.CommandText = "CREATE TABLE t (value INTEGER); INSERT INTO t VALUES (0)";
|
|
seed.ExecuteNonQuery();
|
|
}
|
|
var writer = new Mock<IAuditWriter>();
|
|
writer.Setup(w => w.WriteAsync(It.IsAny<ZB.MOM.WW.Audit.AuditEvent>(), It.IsAny<CancellationToken>()))
|
|
.Returns(Task.CompletedTask);
|
|
await using var connection = new AuditingDbConnection(inner, writer.Object, "db", "site", "instance",
|
|
"script", NullLogger.Instance, Guid.NewGuid());
|
|
await using var transaction = asynchronous
|
|
? await connection.BeginTransactionAsync()
|
|
: connection.BeginTransaction();
|
|
Assert.Same(connection, transaction.Connection);
|
|
using var command = transaction.Connection!.CreateCommand();
|
|
Assert.Same(connection, command.Connection);
|
|
command.Transaction = transaction;
|
|
Assert.Same(transaction, command.Transaction);
|
|
Assert.Same(connection, command.Transaction!.Connection);
|
|
command.CommandText = "UPDATE t SET value = 42";
|
|
Assert.Equal(1, asynchronous ? await command.ExecuteNonQueryAsync() : command.ExecuteNonQuery());
|
|
if (asynchronous) await transaction.CommitAsync(); else transaction.Commit();
|
|
writer.Verify(w => w.WriteAsync(It.IsAny<ZB.MOM.WW.Audit.AuditEvent>(), It.IsAny<CancellationToken>()), Times.Once);
|
|
using var check = inner.CreateCommand();
|
|
check.CommandText = "SELECT value FROM t";
|
|
Assert.Equal(42L, check.ExecuteScalar());
|
|
}
|
|
|
|
[Fact]
|
|
public void SR11_CommandConnectionCannotExposeProvider()
|
|
{
|
|
using var inner = new SqliteConnection("Data Source=:memory:");
|
|
using var connection = new AuditingDbConnection(inner, Mock.Of<IAuditWriter>(), "db", "site", "instance",
|
|
"script", NullLogger.Instance, Guid.NewGuid());
|
|
using var command = connection.CreateCommand();
|
|
Assert.Same(connection, command.Connection);
|
|
}
|
|
[Fact]
|
|
public void SR4_ConnectionCannotBeRetargetedOrRevealCredentials()
|
|
{
|
|
using var inner = new SqliteConnection("Data Source=:memory:;Password=secret-value");
|
|
using var connection = new AuditingDbConnection(inner, Mock.Of<IAuditWriter>(), "MES-Prod", "site", "instance",
|
|
"script", NullLogger.Instance, Guid.NewGuid());
|
|
Assert.DoesNotContain("secret-value", connection.ConnectionString);
|
|
Assert.Throws<NotSupportedException>(() => connection.ConnectionString = "Data Source=other.db");
|
|
Assert.Throws<NotSupportedException>(() => connection.ChangeDatabase("other"));
|
|
Assert.Equal("Data Source=:memory:;Password=secret-value", inner.ConnectionString);
|
|
}
|
|
|
|
}
|