Joseph Doherty
67a3950f74
Final review M3: SecretReferenceScanner.TryParseSecretReference (trimmed, case-insensitive
prefix, trimmed name, empty = not a reference, ${secret:} never matches) is used by the scanner
and by MxGatewayDataConnection's ApiKey resolution, so a padded or case-variant reference
resolves the name central ships. A bare 'secret:' ApiKey now fails closed. M7: unit test pins
stamped hash == ComputeCurrentArtifactHashesAsync with a non-empty Secrets list.
1177 lines
54 KiB
C#
1177 lines
54 KiB
C#
using System.Collections.Concurrent;
|
|
using System.Text.Json;
|
|
using Akka.Actor;
|
|
using Akka.TestKit.Xunit2;
|
|
using Microsoft.Extensions.Logging;
|
|
using Microsoft.Extensions.Logging.Abstractions;
|
|
using Microsoft.Extensions.Options;
|
|
using NSubstitute;
|
|
using ZB.MOM.WW.ScadaBridge.Commons.Entities.Deployment;
|
|
using ZB.MOM.WW.ScadaBridge.Commons.Entities.Sites;
|
|
using ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Repositories;
|
|
using ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Services;
|
|
using ZB.MOM.WW.ScadaBridge.Commons.Messages.Artifacts;
|
|
using ZB.MOM.WW.ScadaBridge.Communication;
|
|
using ZB.MOM.WW.ScadaBridge.Commons.Entities.ExternalSystems;
|
|
using ZB.MOM.WW.Secrets.Abstractions;
|
|
|
|
namespace ZB.MOM.WW.ScadaBridge.DeploymentManager.Tests;
|
|
|
|
/// <summary>
|
|
/// WP-7: Tests for system-wide artifact deployment.
|
|
/// </summary>
|
|
public class ArtifactDeploymentServiceTests : TestKit
|
|
{
|
|
private readonly ISiteRepository _siteRepo;
|
|
private readonly IDeploymentManagerRepository _deploymentRepo;
|
|
private readonly ITemplateEngineRepository _templateRepo;
|
|
private readonly IExternalSystemRepository _externalSystemRepo;
|
|
private readonly INotificationRepository _notificationRepo;
|
|
private readonly IAuditService _audit;
|
|
private readonly ArtifactRevisionHashService _hashService = new();
|
|
private readonly ISecretStore _secretStore;
|
|
|
|
public ArtifactDeploymentServiceTests()
|
|
{
|
|
_siteRepo = Substitute.For<ISiteRepository>();
|
|
_deploymentRepo = Substitute.For<IDeploymentManagerRepository>();
|
|
_templateRepo = Substitute.For<ITemplateEngineRepository>();
|
|
_externalSystemRepo = Substitute.For<IExternalSystemRepository>();
|
|
// DeploymentManager-025/-027: the notification repo is retained only so the
|
|
// tests can assert the artifact path NEVER touches it (it is no longer a
|
|
// constructor dependency of ArtifactDeploymentService).
|
|
_notificationRepo = Substitute.For<INotificationRepository>();
|
|
_audit = Substitute.For<IAuditService>();
|
|
// Unconfigured GetAsync returns null (NSubstitute default), i.e. "not in the store" —
|
|
// exactly the fail-closed posture a test wants unless it explicitly seeds a row.
|
|
_secretStore = Substitute.For<ISecretStore>();
|
|
}
|
|
|
|
private static StoredSecret SecretRow(string name, long revision, string? description = null) => new()
|
|
{
|
|
Name = new SecretName(name),
|
|
Description = description,
|
|
ContentType = SecretContentType.Text,
|
|
Ciphertext = [1, 2, 3],
|
|
Nonce = [4, 5],
|
|
Tag = [6, 7],
|
|
WrappedDek = [8, 9],
|
|
WrapNonce = [10, 11],
|
|
WrapTag = [12, 13],
|
|
KekId = "kek-1",
|
|
Revision = revision,
|
|
CreatedUtc = DateTimeOffset.Parse("2026-01-01T00:00:00Z"),
|
|
UpdatedUtc = DateTimeOffset.Parse("2026-01-02T00:00:00Z"),
|
|
};
|
|
|
|
[Fact]
|
|
public async Task DeployToAllSitesAsync_NoSites_ReturnsFailure()
|
|
{
|
|
_siteRepo.GetAllSitesAsync().Returns(new List<Site>());
|
|
|
|
var service = CreateService();
|
|
|
|
var result = await service.DeployToAllSitesAsync("admin");
|
|
|
|
Assert.True(result.IsFailure);
|
|
Assert.Contains("No sites", result.Error);
|
|
}
|
|
|
|
[Fact]
|
|
public void SiteArtifactResult_ContainsSiteInfo()
|
|
{
|
|
var result = new SiteArtifactResult("site1", "Site One", true, null);
|
|
Assert.Equal("site1", result.SiteId);
|
|
Assert.Equal("Site One", result.SiteName);
|
|
Assert.True(result.Success);
|
|
Assert.Null(result.ErrorMessage);
|
|
}
|
|
|
|
[Fact]
|
|
public void ArtifactDeploymentSummary_CountsCorrectly()
|
|
{
|
|
var results = new List<SiteArtifactResult>
|
|
{
|
|
new("s1", "Site1", true, null),
|
|
new("s2", "Site2", false, "error"),
|
|
new("s3", "Site3", true, null)
|
|
};
|
|
var summary = new ArtifactDeploymentSummary("dep1", results, 2, 1);
|
|
|
|
Assert.Equal(2, summary.SuccessCount);
|
|
Assert.Equal(1, summary.FailureCount);
|
|
Assert.Equal(3, summary.SiteResults.Count);
|
|
}
|
|
|
|
// ── DeploymentManager-010: one logical deployment id across all per-site commands ──
|
|
|
|
[Fact]
|
|
public async Task DeployToAllSitesAsync_AllPerSiteCommandsShareTheSummaryDeploymentId()
|
|
{
|
|
// DeploymentManager-010: previously each per-site DeployArtifactsCommand
|
|
// minted its own GUID, so one logical deployment produced N+1 unrelated
|
|
// ids. Every per-site command must now carry the SAME id, equal to the
|
|
// id reported in the summary and audit log.
|
|
var sites = new List<Site>
|
|
{
|
|
new("Site One", "site-1") { Id = 1 },
|
|
new("Site Two", "site-2") { Id = 2 }
|
|
};
|
|
_siteRepo.GetAllSitesAsync(Arg.Any<CancellationToken>()).Returns(sites);
|
|
var recorder = new ArtifactProbeRecorder();
|
|
var probe = Sys.ActorOf(Props.Create(() => new ArtifactProbeActor(recorder)));
|
|
var service = CreateServiceWithCommActor(probe);
|
|
|
|
var result = await service.DeployToAllSitesAsync("admin");
|
|
|
|
Assert.True(result.IsSuccess);
|
|
var commands = recorder.Received;
|
|
Assert.Equal(2, commands.Count);
|
|
|
|
// All per-site commands carry one shared id, equal to the summary id.
|
|
var distinctIds = commands.Select(c => c.DeploymentId).Distinct().ToList();
|
|
Assert.Single(distinctIds);
|
|
Assert.Equal(result.Value.DeploymentId, distinctIds[0]);
|
|
|
|
// The persisted record embeds the same logical deployment id.
|
|
await _deploymentRepo.Received().AddSystemArtifactDeploymentAsync(
|
|
Arg.Do<SystemArtifactDeploymentRecord>(r =>
|
|
{
|
|
using var doc = JsonDocument.Parse(r.PerSiteStatus!);
|
|
Assert.Equal(result.Value.DeploymentId,
|
|
doc.RootElement.GetProperty("DeploymentId").GetString());
|
|
}),
|
|
Arg.Any<CancellationToken>());
|
|
}
|
|
|
|
// ── DeploymentManager-014: real per-site success/failure coverage ──
|
|
|
|
[Fact]
|
|
public async Task DeployToAllSitesAsync_PartialFailure_ReportsPerSiteMatrix()
|
|
{
|
|
// Site one succeeds, site two fails -> the summary counts must reflect
|
|
// the per-site matrix.
|
|
var sites = new List<Site>
|
|
{
|
|
new("Site One", "ok-site") { Id = 1 },
|
|
new("Site Two", "fail-site") { Id = 2 }
|
|
};
|
|
_siteRepo.GetAllSitesAsync(Arg.Any<CancellationToken>()).Returns(sites);
|
|
var recorder = new ArtifactProbeRecorder();
|
|
var probe = Sys.ActorOf(Props.Create(() => new ArtifactProbeActor(recorder, "fail-site")));
|
|
var service = CreateServiceWithCommActor(probe);
|
|
|
|
var result = await service.DeployToAllSitesAsync("admin");
|
|
|
|
Assert.True(result.IsSuccess);
|
|
Assert.Equal(1, result.Value.SuccessCount);
|
|
Assert.Equal(1, result.Value.FailureCount);
|
|
Assert.Contains(result.Value.SiteResults, r => r.SiteId == "ok-site" && r.Success);
|
|
Assert.Contains(result.Value.SiteResults, r => r.SiteId == "fail-site" && !r.Success);
|
|
}
|
|
|
|
// ── DeploymentManager-023: global artifact queries hoisted out of the per-site loop ──
|
|
|
|
[Fact]
|
|
public async Task DeployToAllSitesAsync_HoistsGlobalArtifactQueriesOutOfPerSiteLoop()
|
|
{
|
|
// DeploymentManager-023: previously each per-site iteration of the deploy-many
|
|
// loop re-issued the global artifact queries (shared scripts, external systems,
|
|
// DB connections) — a textbook N+1 over the global sets. With three sites the
|
|
// queries must now be issued ONCE in total, regardless of site count.
|
|
var sites = new List<Site>
|
|
{
|
|
new("Site One", "site-1") { Id = 1 },
|
|
new("Site Two", "site-2") { Id = 2 },
|
|
new("Site Three", "site-3") { Id = 3 },
|
|
};
|
|
_siteRepo.GetAllSitesAsync(Arg.Any<CancellationToken>()).Returns(sites);
|
|
var recorder = new ArtifactProbeRecorder();
|
|
var probe = Sys.ActorOf(Props.Create(() => new ArtifactProbeActor(recorder)));
|
|
var service = CreateServiceWithCommActor(probe);
|
|
|
|
var result = await service.DeployToAllSitesAsync("admin");
|
|
|
|
Assert.True(result.IsSuccess);
|
|
// Each global query must be called EXACTLY ONCE for the whole multi-site sweep.
|
|
await _templateRepo.Received(1).GetAllSharedScriptsAsync(Arg.Any<CancellationToken>());
|
|
await _externalSystemRepo.Received(1).GetAllExternalSystemsAsync(Arg.Any<CancellationToken>());
|
|
await _externalSystemRepo.Received(1).GetAllDatabaseConnectionsAsync(Arg.Any<CancellationToken>());
|
|
// DeploymentManager-025/-027: notification lists and SMTP configuration are
|
|
// central-only — the artifact path must NEVER fetch them, and the per-site
|
|
// command must NEVER carry them.
|
|
await _notificationRepo.DidNotReceive().GetAllNotificationListsAsync(Arg.Any<CancellationToken>());
|
|
await _notificationRepo.DidNotReceive().GetAllSmtpConfigurationsAsync(Arg.Any<CancellationToken>());
|
|
Assert.All(recorder.Received, cmd =>
|
|
{
|
|
Assert.Null(cmd.NotificationLists);
|
|
Assert.Null(cmd.SmtpConfigurations);
|
|
});
|
|
// The per-site query (data connections) DOES vary per site and must still run
|
|
// once per site.
|
|
await _siteRepo.Received(1).GetDataConnectionsBySiteIdAsync(1, Arg.Any<CancellationToken>());
|
|
await _siteRepo.Received(1).GetDataConnectionsBySiteIdAsync(2, Arg.Any<CancellationToken>());
|
|
await _siteRepo.Received(1).GetDataConnectionsBySiteIdAsync(3, Arg.Any<CancellationToken>());
|
|
}
|
|
|
|
/// <summary>
|
|
/// Deferred-work row 27(a): the per-system retry policy must be projected onto the
|
|
/// artifact that ships to sites. Before the fix <c>ExternalSystemArtifact</c> had no such
|
|
/// fields, so a centrally-configured policy never left central and every site cached call
|
|
/// silently used the engine default (50 x 30 s) — while the sibling
|
|
/// <c>DatabaseConnectionArtifact</c> had always carried its equivalents.
|
|
/// </summary>
|
|
[Fact]
|
|
public async Task DeployedExternalSystemArtifact_CarriesRetryPolicy()
|
|
{
|
|
_externalSystemRepo.GetAllExternalSystemsAsync(Arg.Any<CancellationToken>()).Returns(
|
|
[
|
|
new ExternalSystemDefinition("Mes", "https://mes", "ApiKey")
|
|
{
|
|
Id = 1,
|
|
MaxRetries = 6,
|
|
RetryDelay = TimeSpan.FromSeconds(120),
|
|
},
|
|
]);
|
|
|
|
var recorder = new ArtifactProbeRecorder();
|
|
var probe = Sys.ActorOf(Props.Create(() => new ArtifactProbeActor(recorder)));
|
|
var service = CreateServiceWithCommActor(probe);
|
|
|
|
var result = await service.RetryForSiteAsync(1, "retry-site", "admin");
|
|
|
|
Assert.True(result.IsSuccess);
|
|
var artifact = Assert.Single(Assert.Single(recorder.Received).ExternalSystems!);
|
|
Assert.Equal(6, artifact.MaxRetries);
|
|
Assert.Equal(TimeSpan.FromSeconds(120), artifact.RetryDelay);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task RetryForSiteAsync_SingleSitePath_StillRunsTheGlobalQueriesOnce()
|
|
{
|
|
// DeploymentManager-023: the single-site convenience overload still owns its
|
|
// own global-fetch (it cannot inherit from a sweep), so for one site every
|
|
// global query is issued exactly once. Pin this so a future refactor cannot
|
|
// accidentally route RetryForSiteAsync through the multi-site loop and lose
|
|
// the audit row's deploymentId guarantee.
|
|
var recorder = new ArtifactProbeRecorder();
|
|
var probe = Sys.ActorOf(Props.Create(() => new ArtifactProbeActor(recorder)));
|
|
var service = CreateServiceWithCommActor(probe);
|
|
|
|
var result = await service.RetryForSiteAsync(1, "retry-site", "admin");
|
|
|
|
Assert.True(result.IsSuccess);
|
|
await _templateRepo.Received(1).GetAllSharedScriptsAsync(Arg.Any<CancellationToken>());
|
|
await _externalSystemRepo.Received(1).GetAllExternalSystemsAsync(Arg.Any<CancellationToken>());
|
|
await _externalSystemRepo.Received(1).GetAllDatabaseConnectionsAsync(Arg.Any<CancellationToken>());
|
|
// DeploymentManager-025/-027: central-only — never fetched, never shipped.
|
|
await _notificationRepo.DidNotReceive().GetAllNotificationListsAsync(Arg.Any<CancellationToken>());
|
|
await _notificationRepo.DidNotReceive().GetAllSmtpConfigurationsAsync(Arg.Any<CancellationToken>());
|
|
Assert.All(recorder.Received, cmd =>
|
|
{
|
|
Assert.Null(cmd.NotificationLists);
|
|
Assert.Null(cmd.SmtpConfigurations);
|
|
});
|
|
}
|
|
|
|
[Fact]
|
|
public async Task RetryForSiteAsync_SiteSucceeds_ReturnsSuccessAndAudits()
|
|
{
|
|
var recorder = new ArtifactProbeRecorder();
|
|
var probe = Sys.ActorOf(Props.Create(() => new ArtifactProbeActor(recorder)));
|
|
var service = CreateServiceWithCommActor(probe);
|
|
|
|
var result = await service.RetryForSiteAsync(1, "retry-site", "admin");
|
|
|
|
Assert.True(result.IsSuccess);
|
|
Assert.Equal("retry-site", result.Value.SiteId);
|
|
await _audit.Received().LogAsync(
|
|
"admin", "RetryArtifactDeployment", "SystemArtifact",
|
|
Arg.Any<string>(), "retry-site", Arg.Any<object>(), Arg.Any<CancellationToken>());
|
|
}
|
|
|
|
// ── PLAN-07 Task 4: single-site artifact deployment ──
|
|
|
|
[Fact]
|
|
public async Task DeployToSiteAsync_DeploysOnlyToTargetSite()
|
|
{
|
|
// Two sites exist; deploying to site 1 must build/send exactly one per-site
|
|
// command (for SITE1) and never touch SITE2's per-site data.
|
|
var site1 = new Site("Site One", "SITE1") { Id = 1 };
|
|
_siteRepo.GetSiteByIdAsync(1, Arg.Any<CancellationToken>()).Returns(site1);
|
|
var recorder = new ArtifactProbeRecorder();
|
|
var probe = Sys.ActorOf(Props.Create(() => new ArtifactProbeActor(recorder)));
|
|
var service = CreateServiceWithCommActor(probe);
|
|
|
|
var result = await service.DeployToSiteAsync(1, "tester");
|
|
|
|
Assert.True(result.IsSuccess);
|
|
Assert.Single(result.Value.SiteResults);
|
|
Assert.Equal("SITE1", result.Value.SiteResults[0].SiteId);
|
|
Assert.Single(recorder.Received);
|
|
await _siteRepo.Received(1).GetDataConnectionsBySiteIdAsync(1, Arg.Any<CancellationToken>());
|
|
await _siteRepo.DidNotReceive().GetDataConnectionsBySiteIdAsync(2, Arg.Any<CancellationToken>());
|
|
}
|
|
|
|
[Fact]
|
|
public async Task DeployToSiteAsync_UnknownSite_ReturnsFailure()
|
|
{
|
|
_siteRepo.GetSiteByIdAsync(999, Arg.Any<CancellationToken>()).Returns((Site?)null);
|
|
var service = CreateService();
|
|
|
|
var result = await service.DeployToSiteAsync(999, "tester");
|
|
|
|
Assert.True(result.IsFailure);
|
|
Assert.Contains("999", result.Error);
|
|
}
|
|
|
|
// ── Site artifact revision stamp (pending-updates §3.1) ──
|
|
|
|
[Fact]
|
|
public async Task DeployToAllSitesAsync_SuccessfulSite_StampsHashAndTimestampAndSaves()
|
|
{
|
|
var site = new Site("Site One", "site-1") { Id = 1 };
|
|
_siteRepo.GetAllSitesAsync(Arg.Any<CancellationToken>()).Returns(new List<Site> { site });
|
|
var recorder = new ArtifactProbeRecorder();
|
|
var probe = Sys.ActorOf(Props.Create(() => new ArtifactProbeActor(recorder)));
|
|
var service = CreateServiceWithCommActor(probe);
|
|
var before = DateTimeOffset.UtcNow;
|
|
|
|
var result = await service.DeployToAllSitesAsync("admin");
|
|
|
|
Assert.True(result.IsSuccess);
|
|
var expected = _hashService.ComputeHash(Assert.Single(recorder.Received));
|
|
Assert.Equal(expected, site.ArtifactRevisionHash);
|
|
Assert.NotNull(site.ArtifactsDeployedAt);
|
|
Assert.InRange(site.ArtifactsDeployedAt!.Value, before, DateTimeOffset.UtcNow);
|
|
await _siteRepo.Received(1).UpdateSiteAsync(site, Arg.Any<CancellationToken>());
|
|
await _siteRepo.Received(1).SaveChangesAsync(Arg.Any<CancellationToken>());
|
|
}
|
|
|
|
[Fact]
|
|
public async Task DeployToAllSitesAsync_FailedSite_KeepsItsPreviousStamp()
|
|
{
|
|
// A failed site must keep reading "out of date": it keeps the stamp of whatever
|
|
// artifact set it last received, never the one it just refused.
|
|
var previousStamp = DateTimeOffset.UtcNow.AddDays(-2);
|
|
var ok = new Site("Site One", "ok-site") { Id = 1 };
|
|
var failed = new Site("Site Two", "fail-site")
|
|
{
|
|
Id = 2,
|
|
ArtifactRevisionHash = "sha256:previous",
|
|
ArtifactsDeployedAt = previousStamp
|
|
};
|
|
_siteRepo.GetAllSitesAsync(Arg.Any<CancellationToken>()).Returns(new List<Site> { ok, failed });
|
|
var recorder = new ArtifactProbeRecorder();
|
|
var probe = Sys.ActorOf(Props.Create(() => new ArtifactProbeActor(recorder, "fail-site")));
|
|
var service = CreateServiceWithCommActor(probe);
|
|
|
|
var result = await service.DeployToAllSitesAsync("admin");
|
|
|
|
Assert.True(result.IsSuccess);
|
|
Assert.Equal("sha256:previous", failed.ArtifactRevisionHash);
|
|
Assert.Equal(previousStamp, failed.ArtifactsDeployedAt);
|
|
Assert.NotNull(ok.ArtifactRevisionHash);
|
|
await _siteRepo.DidNotReceive().UpdateSiteAsync(failed, Arg.Any<CancellationToken>());
|
|
await _siteRepo.Received(1).UpdateSiteAsync(ok, Arg.Any<CancellationToken>());
|
|
}
|
|
|
|
[Fact]
|
|
public async Task DeployToAllSitesAsync_StampSaveThrows_DeploymentRecordStillPersistedAndSuccessReported()
|
|
{
|
|
// ORDERING RULE: audit row first, best-effort stamp after. Both repositories are
|
|
// scoped over ONE DbContext, so a failed stamp save leaves the Site entries tracked
|
|
// as Modified — stamping first would let that failure rethrow out of the deployment
|
|
// record's own (uncaught) SaveChangesAsync and lose the audit row for a deploy where
|
|
// every site succeeded. The record must therefore be saved BEFORE the stamp is tried.
|
|
var site = new Site("Site One", "site-1") { Id = 1 };
|
|
_siteRepo.GetAllSitesAsync(Arg.Any<CancellationToken>()).Returns(new List<Site> { site });
|
|
_siteRepo.SaveChangesAsync(Arg.Any<CancellationToken>())
|
|
.Returns<int>(_ => throw new InvalidOperationException("db down"));
|
|
var recorder = new ArtifactProbeRecorder();
|
|
var probe = Sys.ActorOf(Props.Create(() => new ArtifactProbeActor(recorder)));
|
|
var service = CreateServiceWithCommActor(probe);
|
|
|
|
var result = await service.DeployToAllSitesAsync("admin");
|
|
|
|
Assert.True(result.IsSuccess);
|
|
Assert.Equal(1, result.Value.SuccessCount);
|
|
await _deploymentRepo.Received(1).AddSystemArtifactDeploymentAsync(
|
|
Arg.Any<SystemArtifactDeploymentRecord>(), Arg.Any<CancellationToken>());
|
|
await _deploymentRepo.Received(1).SaveChangesAsync(Arg.Any<CancellationToken>());
|
|
Received.InOrder(() =>
|
|
{
|
|
_deploymentRepo.SaveChangesAsync(Arg.Any<CancellationToken>());
|
|
_siteRepo.UpdateSiteAsync(site, Arg.Any<CancellationToken>());
|
|
});
|
|
}
|
|
|
|
[Fact]
|
|
public async Task RetryForSiteAsync_Success_StampsTheSite()
|
|
{
|
|
var site = new Site("Retry Site", "retry-site") { Id = 7 };
|
|
_siteRepo.GetSiteByIdAsync(7, Arg.Any<CancellationToken>()).Returns(site);
|
|
var recorder = new ArtifactProbeRecorder();
|
|
var probe = Sys.ActorOf(Props.Create(() => new ArtifactProbeActor(recorder)));
|
|
var service = CreateServiceWithCommActor(probe);
|
|
|
|
var result = await service.RetryForSiteAsync(7, "retry-site", "admin");
|
|
|
|
Assert.True(result.IsSuccess);
|
|
Assert.Equal(
|
|
_hashService.ComputeHash(Assert.Single(recorder.Received)),
|
|
site.ArtifactRevisionHash);
|
|
Assert.NotNull(site.ArtifactsDeployedAt);
|
|
await _siteRepo.Received(1).UpdateSiteAsync(site, Arg.Any<CancellationToken>());
|
|
await _siteRepo.Received(1).SaveChangesAsync(Arg.Any<CancellationToken>());
|
|
}
|
|
|
|
[Fact]
|
|
public async Task RetryForSiteAsync_Failure_DoesNotStampTheSite()
|
|
{
|
|
var site = new Site("Retry Site", "fail-site") { Id = 7 };
|
|
_siteRepo.GetSiteByIdAsync(7, Arg.Any<CancellationToken>()).Returns(site);
|
|
var recorder = new ArtifactProbeRecorder();
|
|
var probe = Sys.ActorOf(Props.Create(() => new ArtifactProbeActor(recorder, "fail-site")));
|
|
var service = CreateServiceWithCommActor(probe);
|
|
|
|
var result = await service.RetryForSiteAsync(7, "fail-site", "admin");
|
|
|
|
Assert.True(result.IsFailure);
|
|
Assert.Null(site.ArtifactRevisionHash);
|
|
Assert.Null(site.ArtifactsDeployedAt);
|
|
await _siteRepo.DidNotReceive().UpdateSiteAsync(Arg.Any<Site>(), Arg.Any<CancellationToken>());
|
|
}
|
|
|
|
[Fact]
|
|
public async Task ComputeCurrentArtifactHashesAsync_MatchesTheHashADeployStamps()
|
|
{
|
|
// The whole comparison rests on this equality: a "what would it be now" hash of
|
|
// unchanged definitions must equal the hash the last successful deploy stamped.
|
|
var sites = new List<Site>
|
|
{
|
|
new("Site One", "site-1") { Id = 1 },
|
|
new("Site Two", "site-2") { Id = 2 }
|
|
};
|
|
_siteRepo.GetAllSitesAsync(Arg.Any<CancellationToken>()).Returns(sites);
|
|
var recorder = new ArtifactProbeRecorder();
|
|
var probe = Sys.ActorOf(Props.Create(() => new ArtifactProbeActor(recorder)));
|
|
var service = CreateServiceWithCommActor(probe);
|
|
|
|
var deployResult = await service.DeployToAllSitesAsync("admin");
|
|
Assert.True(deployResult.IsSuccess);
|
|
|
|
var current = await service.ComputeCurrentArtifactHashesAsync(sites);
|
|
|
|
Assert.Equal(2, current.Count);
|
|
foreach (var site in sites)
|
|
{
|
|
Assert.Equal(site.ArtifactRevisionHash, current[site.Id]);
|
|
}
|
|
}
|
|
|
|
[Fact]
|
|
public async Task ComputeCurrentArtifactHashesAsync_MatchesTheHashADeployStamps_WithSecrets()
|
|
{
|
|
// Final review M7: the parity above runs with no data connections. Pin it for a site
|
|
// whose connections reference secrets, so the stamped hash (built from a command that
|
|
// carries a non-empty Secrets list) equals the "what would it be now" hash — a
|
|
// successful secrets deploy must read Current, not Out of date.
|
|
var site = new Site("Site One", "site-1") { Id = 1 };
|
|
var sites = new List<Site> { site };
|
|
_siteRepo.GetAllSitesAsync(Arg.Any<CancellationToken>()).Returns(sites);
|
|
_siteRepo.GetDataConnectionsBySiteIdAsync(1, Arg.Any<CancellationToken>())
|
|
.Returns(new List<DataConnection>
|
|
{
|
|
new("GW1", "MxGateway", 1)
|
|
{
|
|
PrimaryConfiguration = """{"ApiKey":"secret:key1","Password":"secret:key2"}"""
|
|
}
|
|
});
|
|
_secretStore.GetAsync(Arg.Is<SecretName>(n => n.Value == "key1"), Arg.Any<CancellationToken>())
|
|
.Returns(Task.FromResult<StoredSecret?>(SecretRow("key1", 3)));
|
|
_secretStore.GetAsync(Arg.Is<SecretName>(n => n.Value == "key2"), Arg.Any<CancellationToken>())
|
|
.Returns(Task.FromResult<StoredSecret?>(SecretRow("key2", 7)));
|
|
|
|
var recorder = new ArtifactProbeRecorder();
|
|
var probe = Sys.ActorOf(Props.Create(() => new SecretsAckProbeActor(
|
|
recorder, cmd => cmd.Secrets == null ? (int?)null : cmd.Secrets.Count)));
|
|
var service = CreateServiceWithCommActor(probe);
|
|
|
|
var deployResult = await service.DeployToAllSitesAsync("admin");
|
|
Assert.True(deployResult.IsSuccess);
|
|
Assert.Equal(1, deployResult.Value.SuccessCount);
|
|
var shipped = Assert.Single(recorder.Received);
|
|
Assert.Equal(2, shipped.Secrets!.Count);
|
|
Assert.NotNull(site.ArtifactRevisionHash);
|
|
|
|
var current = await service.ComputeCurrentArtifactHashesAsync(sites);
|
|
|
|
Assert.Equal(site.ArtifactRevisionHash, current[site.Id]);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task ComputeCurrentArtifactHashesAsync_HoistsTheGlobalQueriesOnce()
|
|
{
|
|
var sites = new List<Site>
|
|
{
|
|
new("Site One", "site-1") { Id = 1 },
|
|
new("Site Two", "site-2") { Id = 2 },
|
|
new("Site Three", "site-3") { Id = 3 }
|
|
};
|
|
var service = CreateService();
|
|
|
|
var current = await service.ComputeCurrentArtifactHashesAsync(sites);
|
|
|
|
Assert.Equal(3, current.Count);
|
|
await _templateRepo.Received(1).GetAllSharedScriptsAsync(Arg.Any<CancellationToken>());
|
|
await _externalSystemRepo.Received(1).GetAllExternalSystemsAsync(Arg.Any<CancellationToken>());
|
|
await _externalSystemRepo.Received(1).GetAllDatabaseConnectionsAsync(Arg.Any<CancellationToken>());
|
|
await _siteRepo.Received(1).GetDataConnectionsBySiteIdAsync(1, Arg.Any<CancellationToken>());
|
|
await _siteRepo.Received(1).GetDataConnectionsBySiteIdAsync(3, Arg.Any<CancellationToken>());
|
|
}
|
|
|
|
[Fact]
|
|
public async Task ComputeCurrentArtifactHashesAsync_NoSites_ReturnsEmptyWithoutQuerying()
|
|
{
|
|
var service = CreateService();
|
|
|
|
var current = await service.ComputeCurrentArtifactHashesAsync([]);
|
|
|
|
Assert.Empty(current);
|
|
await _templateRepo.DidNotReceive().GetAllSharedScriptsAsync(Arg.Any<CancellationToken>());
|
|
}
|
|
|
|
// ── Secrets ride the artifact deploy (design §3.1/§3.3) ──
|
|
|
|
[Fact]
|
|
public async Task DeployToAllSites_SiteWithMissingSecret_FailsThatSiteOnly_AndSendsNothingToIt()
|
|
{
|
|
var sites = new List<Site>
|
|
{
|
|
new("Site One", "ok-site") { Id = 1 },
|
|
new("Site Two", "bad-site") { Id = 2 }
|
|
};
|
|
_siteRepo.GetAllSitesAsync(Arg.Any<CancellationToken>()).Returns(sites);
|
|
_siteRepo.GetDataConnectionsBySiteIdAsync(1, Arg.Any<CancellationToken>())
|
|
.Returns(new List<DataConnection>());
|
|
_siteRepo.GetDataConnectionsBySiteIdAsync(2, Arg.Any<CancellationToken>())
|
|
.Returns(new List<DataConnection>
|
|
{
|
|
new("GW1", "MxGateway", 2) { PrimaryConfiguration = """{"ApiKey":"secret:missing-key"}""" }
|
|
});
|
|
// _secretStore is unconfigured for "missing-key" — GetAsync returns null (absent).
|
|
|
|
var recorder = new ArtifactProbeRecorder();
|
|
var probe = Sys.ActorOf(Props.Create(() => new ArtifactProbeActor(recorder)));
|
|
var service = CreateServiceWithCommActor(probe);
|
|
|
|
var result = await service.DeployToAllSitesAsync("admin");
|
|
|
|
Assert.True(result.IsSuccess);
|
|
Assert.Equal(1, result.Value.SuccessCount);
|
|
Assert.Equal(1, result.Value.FailureCount);
|
|
Assert.Contains(result.Value.SiteResults, r => r.SiteId == "ok-site" && r.Success);
|
|
var badResult = Assert.Single(result.Value.SiteResults, r => r.SiteId == "bad-site");
|
|
Assert.False(badResult.Success);
|
|
Assert.Equal(
|
|
"Secret 'missing-key' referenced by data connection(s) GW1 is not in the central secret store",
|
|
badResult.ErrorMessage);
|
|
|
|
// Nothing was sent to the bad site: the probe only ever saw ok-site's command.
|
|
var sentCommand = Assert.Single(recorder.Received);
|
|
Assert.DoesNotContain(
|
|
sentCommand.DataConnections ?? [],
|
|
dc => dc.Name == "GW1");
|
|
|
|
// The bad site keeps no stamp — it still reads "out of date" / "never deployed".
|
|
var badSite = sites.Single(s => s.SiteIdentifier == "bad-site");
|
|
Assert.Null(badSite.ArtifactRevisionHash);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task ComputeCurrentHashes_MissingSecret_UsesMissingMarker()
|
|
{
|
|
var site = new Site("Site One", "site-1") { Id = 1 };
|
|
_siteRepo.GetDataConnectionsBySiteIdAsync(1, Arg.Any<CancellationToken>())
|
|
.Returns(new List<DataConnection>
|
|
{
|
|
new("GW1", "MxGateway", 1) { PrimaryConfiguration = """{"ApiKey":"secret:the-key"}""" }
|
|
});
|
|
var service = CreateService();
|
|
|
|
// The reference does not resolve yet: ComputeCurrentArtifactHashesAsync must not
|
|
// fail the call — it folds a Missing marker into the hash instead.
|
|
var beforeCreated = await service.ComputeCurrentArtifactHashesAsync([site]);
|
|
|
|
// The secret now exists in the store.
|
|
_secretStore.GetAsync(Arg.Is<SecretName>(n => n.Value == "the-key"), Arg.Any<CancellationToken>())
|
|
.Returns(Task.FromResult<StoredSecret?>(SecretRow("the-key", 1)));
|
|
var afterCreated = await service.ComputeCurrentArtifactHashesAsync([site]);
|
|
|
|
Assert.NotEqual(beforeCreated[1], afterCreated[1]);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task DeployLogs_NeverContainSecretMaterial()
|
|
{
|
|
var ciphertext = new byte[] { 0xDE, 0xAD, 0xBE, 0xEF, 0x13, 0x37 };
|
|
var resolvedRow = SecretRow("present-key", 5) with { Ciphertext = ciphertext };
|
|
var ciphertextBase64 = Convert.ToBase64String(ciphertext);
|
|
var ciphertextHex = Convert.ToHexString(ciphertext);
|
|
|
|
var sites = new List<Site>
|
|
{
|
|
new("Site One", "ok-site") { Id = 1 },
|
|
new("Site Two", "bad-site") { Id = 2 }
|
|
};
|
|
_siteRepo.GetAllSitesAsync(Arg.Any<CancellationToken>()).Returns(sites);
|
|
_siteRepo.GetDataConnectionsBySiteIdAsync(1, Arg.Any<CancellationToken>())
|
|
.Returns(new List<DataConnection>
|
|
{
|
|
new("GW1", "MxGateway", 1) { PrimaryConfiguration = """{"ApiKey":"secret:present-key"}""" }
|
|
});
|
|
_siteRepo.GetDataConnectionsBySiteIdAsync(2, Arg.Any<CancellationToken>())
|
|
.Returns(new List<DataConnection>
|
|
{
|
|
new("GW2", "MxGateway", 2) { PrimaryConfiguration = """{"ApiKey":"secret:missing-key"}""" }
|
|
});
|
|
_secretStore.GetAsync(Arg.Is<SecretName>(n => n.Value == "present-key"), Arg.Any<CancellationToken>())
|
|
.Returns(Task.FromResult<StoredSecret?>(resolvedRow));
|
|
|
|
var recorder = new ArtifactProbeRecorder();
|
|
// Task 7: ok-site's command ships one secret, so the probe must ack it (SecretsApplied
|
|
// = shipped count) for the site to reconcile as a success — an unset SecretsApplied
|
|
// now reads as an old site (see the dedicated reconciliation tests below).
|
|
var probe = Sys.ActorOf(Props.Create(() =>
|
|
new SecretsAckProbeActor(recorder, cmd => cmd.Secrets == null ? (int?)null : cmd.Secrets.Count)));
|
|
var capturingLogger = new CapturingLogger<ArtifactDeploymentService>();
|
|
var service = CreateServiceWithCommActor(probe, capturingLogger);
|
|
|
|
var result = await service.DeployToAllSitesAsync("admin");
|
|
|
|
Assert.True(result.IsSuccess);
|
|
Assert.Equal(1, result.Value.SuccessCount);
|
|
Assert.Equal(1, result.Value.FailureCount);
|
|
|
|
// The Information/Error lines still name what shipped and what didn't ...
|
|
Assert.Contains(capturingLogger.Messages, m => m.Contains("present-key@r5"));
|
|
Assert.Contains(capturingLogger.Messages, m => m.Contains("missing-key"));
|
|
Assert.Contains(capturingLogger.Messages, m => m.Contains("not in the central secret store"));
|
|
|
|
// ... but never the ciphertext, in any rendering, in any log message or exception text.
|
|
Assert.DoesNotContain(capturingLogger.Messages, m => m.Contains(ciphertextBase64));
|
|
Assert.DoesNotContain(capturingLogger.Messages, m => m.Contains(ciphertextHex));
|
|
Assert.DoesNotContain(capturingLogger.Messages, m => m.Contains(ciphertextHex, StringComparison.OrdinalIgnoreCase));
|
|
}
|
|
|
|
// ── Task 7: stamp gating on secret application + DeploySiteSecrets audit row ──
|
|
|
|
[Fact]
|
|
public async Task OldSite_NullSecretsApplied_WithSecrets_FailsAndDoesNotStamp()
|
|
{
|
|
// The site's build predates the secrets feature: it acks the artifact deploy as a
|
|
// whole (Success=true) but never populates SecretsApplied, silently ignoring the new
|
|
// proto field. That must not read as "the secret was applied".
|
|
var site = new Site("Site One", "site-1") { Id = 1 };
|
|
_siteRepo.GetAllSitesAsync(Arg.Any<CancellationToken>()).Returns(new List<Site> { site });
|
|
_siteRepo.GetDataConnectionsBySiteIdAsync(1, Arg.Any<CancellationToken>())
|
|
.Returns(new List<DataConnection>
|
|
{
|
|
new("GW1", "MxGateway", 1) { PrimaryConfiguration = """{"ApiKey":"secret:the-key"}""" }
|
|
});
|
|
_secretStore.GetAsync(Arg.Is<SecretName>(n => n.Value == "the-key"), Arg.Any<CancellationToken>())
|
|
.Returns(Task.FromResult<StoredSecret?>(SecretRow("the-key", 1)));
|
|
|
|
var recorder = new ArtifactProbeRecorder();
|
|
var probe = Sys.ActorOf(Props.Create(() => new SecretsAckProbeActor(recorder, _ => null)));
|
|
var service = CreateServiceWithCommActor(probe);
|
|
|
|
var result = await service.DeployToAllSitesAsync("admin");
|
|
|
|
Assert.True(result.IsSuccess);
|
|
Assert.Equal(0, result.Value.SuccessCount);
|
|
Assert.Equal(1, result.Value.FailureCount);
|
|
var siteResult = Assert.Single(result.Value.SiteResults);
|
|
Assert.False(siteResult.Success);
|
|
Assert.Equal(
|
|
"Site build predates secret deployment — upgrade the site before deploying secrets",
|
|
siteResult.ErrorMessage);
|
|
Assert.Null(siteResult.SecretsDeployed);
|
|
Assert.Null(site.ArtifactRevisionHash);
|
|
Assert.Null(site.ArtifactsDeployedAt);
|
|
await _siteRepo.DidNotReceive().UpdateSiteAsync(site, Arg.Any<CancellationToken>());
|
|
}
|
|
|
|
[Fact]
|
|
public async Task PartialApply_FailsAndDoesNotStamp()
|
|
{
|
|
// The site applied 1 of the 2 shipped secrets (a partial local failure). Success=true
|
|
// on the wire response is not enough — the count must match exactly.
|
|
var site = new Site("Site One", "site-1") { Id = 1 };
|
|
_siteRepo.GetAllSitesAsync(Arg.Any<CancellationToken>()).Returns(new List<Site> { site });
|
|
_siteRepo.GetDataConnectionsBySiteIdAsync(1, Arg.Any<CancellationToken>())
|
|
.Returns(new List<DataConnection>
|
|
{
|
|
new("GW1", "MxGateway", 1)
|
|
{
|
|
PrimaryConfiguration = """{"ApiKey":"secret:key1","Password":"secret:key2"}"""
|
|
}
|
|
});
|
|
_secretStore.GetAsync(Arg.Is<SecretName>(n => n.Value == "key1"), Arg.Any<CancellationToken>())
|
|
.Returns(Task.FromResult<StoredSecret?>(SecretRow("key1", 1)));
|
|
_secretStore.GetAsync(Arg.Is<SecretName>(n => n.Value == "key2"), Arg.Any<CancellationToken>())
|
|
.Returns(Task.FromResult<StoredSecret?>(SecretRow("key2", 1)));
|
|
|
|
var recorder = new ArtifactProbeRecorder();
|
|
var probe = Sys.ActorOf(Props.Create(() => new SecretsAckProbeActor(recorder, _ => 1)));
|
|
var service = CreateServiceWithCommActor(probe);
|
|
|
|
var result = await service.DeployToAllSitesAsync("admin");
|
|
|
|
Assert.True(result.IsSuccess);
|
|
Assert.Equal(0, result.Value.SuccessCount);
|
|
Assert.Equal(1, result.Value.FailureCount);
|
|
var siteResult = Assert.Single(result.Value.SiteResults);
|
|
Assert.False(siteResult.Success);
|
|
Assert.Equal("Site applied 1 of 2 secrets", siteResult.ErrorMessage);
|
|
Assert.Equal(1, siteResult.SecretsDeployed);
|
|
Assert.Null(site.ArtifactRevisionHash);
|
|
await _siteRepo.DidNotReceive().UpdateSiteAsync(site, Arg.Any<CancellationToken>());
|
|
}
|
|
|
|
[Fact]
|
|
public async Task OldSite_NoSecrets_StillStamps()
|
|
{
|
|
// No data connection references a secret at all, so the command ships zero secrets.
|
|
// An old site's SecretsApplied=null reply must NOT gate the stamp in this case —
|
|
// unchanged behaviour.
|
|
var site = new Site("Site One", "site-1") { Id = 1 };
|
|
_siteRepo.GetAllSitesAsync(Arg.Any<CancellationToken>()).Returns(new List<Site> { site });
|
|
_siteRepo.GetDataConnectionsBySiteIdAsync(1, Arg.Any<CancellationToken>())
|
|
.Returns(new List<DataConnection>());
|
|
|
|
var recorder = new ArtifactProbeRecorder();
|
|
var probe = Sys.ActorOf(Props.Create(() => new ArtifactProbeActor(recorder)));
|
|
var service = CreateServiceWithCommActor(probe);
|
|
|
|
var result = await service.DeployToAllSitesAsync("admin");
|
|
|
|
Assert.True(result.IsSuccess);
|
|
Assert.Equal(1, result.Value.SuccessCount);
|
|
var siteResult = Assert.Single(result.Value.SiteResults);
|
|
Assert.True(siteResult.Success);
|
|
Assert.Null(siteResult.SecretsDeployed);
|
|
Assert.NotNull(site.ArtifactRevisionHash);
|
|
await _siteRepo.Received(1).UpdateSiteAsync(site, Arg.Any<CancellationToken>());
|
|
}
|
|
|
|
[Fact]
|
|
public async Task NoSecretReferences_ShipsEmptySecretsList_SoTheSiteRemovesPreviouslyDeployedOnes()
|
|
{
|
|
// The site applies DeployArtifactsCommand.Secrets as the FULL set: rows absent from it
|
|
// are marked removed and the mirror deletes them, while a NULL Secrets means "central
|
|
// shipped no secrets" and touches nothing. Dropping a site's LAST secret reference must
|
|
// therefore ship an empty list, not null — otherwise the previously deployed secret stays
|
|
// live on both site nodes forever (Task 13 live gate, check 5).
|
|
var site = new Site("Site One", "site-1") { Id = 1 };
|
|
_siteRepo.GetAllSitesAsync(Arg.Any<CancellationToken>()).Returns(new List<Site> { site });
|
|
_siteRepo.GetDataConnectionsBySiteIdAsync(1, Arg.Any<CancellationToken>())
|
|
.Returns(new List<DataConnection>
|
|
{
|
|
new("GW1", "MxGateway", 1) { PrimaryConfiguration = """{"ApiKey":"a-literal-key"}""" }
|
|
});
|
|
|
|
var recorder = new ArtifactProbeRecorder();
|
|
var probe = Sys.ActorOf(Props.Create(() => new SecretsAckProbeActor(recorder, _ => 0)));
|
|
var service = CreateServiceWithCommActor(probe);
|
|
|
|
var result = await service.DeployToAllSitesAsync("admin");
|
|
|
|
Assert.True(result.IsSuccess);
|
|
var cmd = Assert.Single(recorder.Received);
|
|
Assert.NotNull(cmd.Secrets);
|
|
Assert.Empty(cmd.Secrets!);
|
|
Assert.Null(cmd.MissingSecrets);
|
|
var siteResult = Assert.Single(result.Value.SiteResults);
|
|
Assert.True(siteResult.Success);
|
|
// Nothing shipped => nothing to confirm; SecretsDeployed stays null, and no
|
|
// DeploySiteSecrets audit row is written for a deploy that carried no secrets.
|
|
Assert.Null(siteResult.SecretsDeployed);
|
|
Assert.NotNull(site.ArtifactRevisionHash);
|
|
await _audit.DidNotReceive().LogAsync(
|
|
Arg.Any<string>(), "DeploySiteSecrets", Arg.Any<string>(), Arg.Any<string>(),
|
|
Arg.Any<string>(), Arg.Any<object?>(), Arg.Any<CancellationToken>());
|
|
}
|
|
|
|
[Fact]
|
|
public async Task SecretDeploy_WritesOneAuditRowPerSite_WithoutMaterial()
|
|
{
|
|
var ciphertext = new byte[] { 0xDE, 0xAD, 0xBE, 0xEF, 0x13, 0x37 };
|
|
var resolvedRow = SecretRow("present-key", 3) with { Ciphertext = ciphertext };
|
|
var ciphertextBase64 = Convert.ToBase64String(ciphertext);
|
|
var ciphertextHex = Convert.ToHexString(ciphertext);
|
|
|
|
var secretSite = new Site("Secret Site", "sec-site") { Id = 1 };
|
|
var plainSite = new Site("Plain Site", "plain-site") { Id = 2 };
|
|
_siteRepo.GetAllSitesAsync(Arg.Any<CancellationToken>()).Returns(new List<Site> { secretSite, plainSite });
|
|
_siteRepo.GetDataConnectionsBySiteIdAsync(1, Arg.Any<CancellationToken>())
|
|
.Returns(new List<DataConnection>
|
|
{
|
|
new("GW1", "MxGateway", 1) { PrimaryConfiguration = """{"ApiKey":"secret:present-key"}""" }
|
|
});
|
|
_siteRepo.GetDataConnectionsBySiteIdAsync(2, Arg.Any<CancellationToken>())
|
|
.Returns(new List<DataConnection>());
|
|
_secretStore.GetAsync(Arg.Is<SecretName>(n => n.Value == "present-key"), Arg.Any<CancellationToken>())
|
|
.Returns(Task.FromResult<StoredSecret?>(resolvedRow));
|
|
|
|
var recorder = new ArtifactProbeRecorder();
|
|
// Correctly acks whatever it received, so this test exercises only the audit-row
|
|
// requirement, not the reconciliation-failure paths covered above.
|
|
var probe = Sys.ActorOf(Props.Create(() =>
|
|
new SecretsAckProbeActor(recorder, cmd => cmd.Secrets == null ? (int?)null : cmd.Secrets.Count)));
|
|
var service = CreateServiceWithCommActor(probe);
|
|
|
|
object? captured = null;
|
|
var callCount = 0;
|
|
_audit.When(x => x.LogAsync(
|
|
Arg.Any<string>(), "DeploySiteSecrets", Arg.Any<string>(), Arg.Any<string>(), Arg.Any<string>(),
|
|
Arg.Any<object>(), Arg.Any<CancellationToken>()))
|
|
.Do(ci =>
|
|
{
|
|
callCount++;
|
|
if ((string)ci[3] == "sec-site")
|
|
{
|
|
Assert.Equal("admin", ci[0]);
|
|
Assert.Equal("SiteSecrets", ci[2]);
|
|
Assert.Equal("Secret Site", ci[4]);
|
|
captured = ci[5];
|
|
}
|
|
else
|
|
{
|
|
Assert.Fail($"Unexpected DeploySiteSecrets row for site '{ci[3]}' — only sec-site has secret refs.");
|
|
}
|
|
});
|
|
|
|
var result = await service.DeployToAllSitesAsync("admin");
|
|
|
|
Assert.True(result.IsSuccess);
|
|
Assert.Equal(2, result.Value.SuccessCount);
|
|
|
|
// Exactly one DeploySiteSecrets row — for sec-site only; plain-site has no secret
|
|
// references at all and gets none.
|
|
Assert.Equal(1, callCount);
|
|
Assert.NotNull(captured);
|
|
var json = JsonSerializer.Serialize(captured);
|
|
Assert.Contains("present-key", json);
|
|
Assert.Contains("\"revision\":3", json);
|
|
Assert.Contains("\"success\":true", json);
|
|
|
|
// ... but never any secret material, in any rendering.
|
|
Assert.DoesNotContain(ciphertextBase64, json);
|
|
Assert.DoesNotContain(ciphertextHex, json);
|
|
Assert.DoesNotContain(ciphertextHex, json, StringComparison.OrdinalIgnoreCase);
|
|
Assert.DoesNotContain("Ciphertext", json, StringComparison.OrdinalIgnoreCase);
|
|
Assert.DoesNotContain("Nonce", json, StringComparison.OrdinalIgnoreCase);
|
|
Assert.DoesNotContain("WrappedDek", json, StringComparison.OrdinalIgnoreCase);
|
|
Assert.DoesNotContain("WrapNonce", json, StringComparison.OrdinalIgnoreCase);
|
|
Assert.DoesNotContain("WrapTag", json, StringComparison.OrdinalIgnoreCase);
|
|
Assert.DoesNotContain("\"tag\"", json, StringComparison.OrdinalIgnoreCase);
|
|
}
|
|
|
|
// ── Task 7 fix round 1: the same gate + audit row on the RetryForSiteAsync path ──
|
|
// (review gap: only the DeployToAllSitesAsync/sweep path had coverage above)
|
|
|
|
[Fact]
|
|
public async Task RetryForSiteAsync_OldSite_NullSecretsApplied_WithSecrets_FailsAndDoesNotStamp()
|
|
{
|
|
var site = new Site("Retry Site", "retry-site") { Id = 7 };
|
|
_siteRepo.GetSiteByIdAsync(7, Arg.Any<CancellationToken>()).Returns(site);
|
|
_siteRepo.GetDataConnectionsBySiteIdAsync(7, Arg.Any<CancellationToken>())
|
|
.Returns(new List<DataConnection>
|
|
{
|
|
new("GW1", "MxGateway", 7) { PrimaryConfiguration = """{"ApiKey":"secret:the-key"}""" }
|
|
});
|
|
_secretStore.GetAsync(Arg.Is<SecretName>(n => n.Value == "the-key"), Arg.Any<CancellationToken>())
|
|
.Returns(Task.FromResult<StoredSecret?>(SecretRow("the-key", 1)));
|
|
|
|
var recorder = new ArtifactProbeRecorder();
|
|
var probe = Sys.ActorOf(Props.Create(() => new SecretsAckProbeActor(recorder, _ => null)));
|
|
var service = CreateServiceWithCommActor(probe);
|
|
|
|
var result = await service.RetryForSiteAsync(7, "retry-site", "admin");
|
|
|
|
Assert.True(result.IsFailure);
|
|
Assert.Equal(
|
|
"Site build predates secret deployment — upgrade the site before deploying secrets",
|
|
result.Error);
|
|
Assert.Null(site.ArtifactRevisionHash);
|
|
Assert.Null(site.ArtifactsDeployedAt);
|
|
await _siteRepo.DidNotReceive().UpdateSiteAsync(Arg.Any<Site>(), Arg.Any<CancellationToken>());
|
|
}
|
|
|
|
[Fact]
|
|
public async Task RetryForSiteAsync_PartialApply_FailsAndDoesNotStamp()
|
|
{
|
|
var site = new Site("Retry Site", "retry-site") { Id = 7 };
|
|
_siteRepo.GetSiteByIdAsync(7, Arg.Any<CancellationToken>()).Returns(site);
|
|
_siteRepo.GetDataConnectionsBySiteIdAsync(7, Arg.Any<CancellationToken>())
|
|
.Returns(new List<DataConnection>
|
|
{
|
|
new("GW1", "MxGateway", 7)
|
|
{
|
|
PrimaryConfiguration = """{"ApiKey":"secret:key1","Password":"secret:key2"}"""
|
|
}
|
|
});
|
|
_secretStore.GetAsync(Arg.Is<SecretName>(n => n.Value == "key1"), Arg.Any<CancellationToken>())
|
|
.Returns(Task.FromResult<StoredSecret?>(SecretRow("key1", 1)));
|
|
_secretStore.GetAsync(Arg.Is<SecretName>(n => n.Value == "key2"), Arg.Any<CancellationToken>())
|
|
.Returns(Task.FromResult<StoredSecret?>(SecretRow("key2", 1)));
|
|
|
|
var recorder = new ArtifactProbeRecorder();
|
|
var probe = Sys.ActorOf(Props.Create(() => new SecretsAckProbeActor(recorder, _ => 1)));
|
|
var service = CreateServiceWithCommActor(probe);
|
|
|
|
var result = await service.RetryForSiteAsync(7, "retry-site", "admin");
|
|
|
|
Assert.True(result.IsFailure);
|
|
Assert.Equal("Site applied 1 of 2 secrets", result.Error);
|
|
Assert.Null(site.ArtifactRevisionHash);
|
|
await _siteRepo.DidNotReceive().UpdateSiteAsync(Arg.Any<Site>(), Arg.Any<CancellationToken>());
|
|
}
|
|
|
|
[Fact]
|
|
public async Task RetryForSiteAsync_MissingSecret_FailsClosed_SendsNothing_WritesOneAuditRow()
|
|
{
|
|
_siteRepo.GetDataConnectionsBySiteIdAsync(7, Arg.Any<CancellationToken>())
|
|
.Returns(new List<DataConnection>
|
|
{
|
|
new("GW1", "MxGateway", 7) { PrimaryConfiguration = """{"ApiKey":"secret:missing-key"}""" }
|
|
});
|
|
// _secretStore is unconfigured for "missing-key" — GetAsync returns null (absent).
|
|
|
|
var recorder = new ArtifactProbeRecorder();
|
|
var probe = Sys.ActorOf(Props.Create(() => new ArtifactProbeActor(recorder)));
|
|
var service = CreateServiceWithCommActor(probe);
|
|
|
|
object? captured = null;
|
|
var callCount = 0;
|
|
_audit.When(x => x.LogAsync(
|
|
Arg.Any<string>(), "DeploySiteSecrets", Arg.Any<string>(), Arg.Any<string>(), Arg.Any<string>(),
|
|
Arg.Any<object>(), Arg.Any<CancellationToken>()))
|
|
.Do(ci =>
|
|
{
|
|
callCount++;
|
|
Assert.Equal("admin", ci[0]);
|
|
Assert.Equal("SiteSecrets", ci[2]);
|
|
Assert.Equal("retry-site", ci[3]);
|
|
Assert.Equal("retry-site", ci[4]);
|
|
captured = ci[5];
|
|
});
|
|
|
|
var result = await service.RetryForSiteAsync(7, "retry-site", "admin");
|
|
|
|
Assert.True(result.IsFailure);
|
|
Assert.Equal(
|
|
"Secret 'missing-key' referenced by data connection(s) GW1 is not in the central secret store",
|
|
result.Error);
|
|
|
|
// Nothing was sent to the site at all.
|
|
Assert.Empty(recorder.Received);
|
|
|
|
// Exactly one DeploySiteSecrets row, naming the missing secret, success=false.
|
|
Assert.Equal(1, callCount);
|
|
Assert.NotNull(captured);
|
|
var json = JsonSerializer.Serialize(captured);
|
|
Assert.Contains("missing-key", json);
|
|
Assert.Contains("\"success\":false", json);
|
|
Assert.Contains("\"secrets\":[]", json);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task RetryForSiteAsync_HappyPath_WithSecrets_StampsAndWritesOneAuditRow()
|
|
{
|
|
var ciphertext = new byte[] { 0xDE, 0xAD, 0xBE, 0xEF };
|
|
var resolvedRow = SecretRow("present-key", 5) with { Ciphertext = ciphertext };
|
|
var ciphertextBase64 = Convert.ToBase64String(ciphertext);
|
|
|
|
var site = new Site("Retry Site", "retry-site") { Id = 7 };
|
|
_siteRepo.GetSiteByIdAsync(7, Arg.Any<CancellationToken>()).Returns(site);
|
|
_siteRepo.GetDataConnectionsBySiteIdAsync(7, Arg.Any<CancellationToken>())
|
|
.Returns(new List<DataConnection>
|
|
{
|
|
new("GW1", "MxGateway", 7) { PrimaryConfiguration = """{"ApiKey":"secret:present-key"}""" }
|
|
});
|
|
_secretStore.GetAsync(Arg.Is<SecretName>(n => n.Value == "present-key"), Arg.Any<CancellationToken>())
|
|
.Returns(Task.FromResult<StoredSecret?>(resolvedRow));
|
|
|
|
var recorder = new ArtifactProbeRecorder();
|
|
var probe = Sys.ActorOf(Props.Create(() =>
|
|
new SecretsAckProbeActor(recorder, cmd => cmd.Secrets == null ? (int?)null : cmd.Secrets.Count)));
|
|
var service = CreateServiceWithCommActor(probe);
|
|
|
|
object? captured = null;
|
|
var callCount = 0;
|
|
_audit.When(x => x.LogAsync(
|
|
Arg.Any<string>(), "DeploySiteSecrets", Arg.Any<string>(), Arg.Any<string>(), Arg.Any<string>(),
|
|
Arg.Any<object>(), Arg.Any<CancellationToken>()))
|
|
.Do(ci =>
|
|
{
|
|
callCount++;
|
|
Assert.Equal("retry-site", ci[3]);
|
|
captured = ci[5];
|
|
});
|
|
|
|
var result = await service.RetryForSiteAsync(7, "retry-site", "admin");
|
|
|
|
Assert.True(result.IsSuccess);
|
|
Assert.Equal(1, result.Value.SecretsDeployed);
|
|
Assert.Equal(
|
|
_hashService.ComputeHash(Assert.Single(recorder.Received)),
|
|
site.ArtifactRevisionHash);
|
|
Assert.NotNull(site.ArtifactsDeployedAt);
|
|
await _siteRepo.Received(1).UpdateSiteAsync(site, Arg.Any<CancellationToken>());
|
|
|
|
Assert.Equal(1, callCount);
|
|
Assert.NotNull(captured);
|
|
var json = JsonSerializer.Serialize(captured);
|
|
Assert.Contains("present-key", json);
|
|
Assert.Contains("\"revision\":5", json);
|
|
Assert.Contains("\"success\":true", json);
|
|
Assert.Contains("\"missing\":[]", json);
|
|
Assert.DoesNotContain(ciphertextBase64, json);
|
|
Assert.DoesNotContain("Ciphertext", json, StringComparison.OrdinalIgnoreCase);
|
|
}
|
|
|
|
private ArtifactDeploymentService CreateService(ILogger<ArtifactDeploymentService>? logger = null)
|
|
{
|
|
var comms = new CommunicationService(
|
|
Options.Create(new CommunicationOptions()),
|
|
NullLogger<CommunicationService>.Instance);
|
|
|
|
return new ArtifactDeploymentService(
|
|
_siteRepo, _deploymentRepo, _templateRepo, _externalSystemRepo, _notificationRepo,
|
|
comms, _audit,
|
|
Options.Create(new DeploymentManagerOptions()),
|
|
logger ?? NullLogger<ArtifactDeploymentService>.Instance,
|
|
_hashService,
|
|
new SiteSecretsCollector(_secretStore));
|
|
}
|
|
|
|
private ArtifactDeploymentService CreateServiceWithCommActor(
|
|
IActorRef commActor, ILogger<ArtifactDeploymentService>? logger = null)
|
|
{
|
|
var comms = new CommunicationService(
|
|
Options.Create(new CommunicationOptions
|
|
{
|
|
ArtifactDeploymentTimeout = TimeSpan.FromSeconds(5)
|
|
}),
|
|
NullLogger<CommunicationService>.Instance);
|
|
comms.SetCommunicationActor(commActor);
|
|
|
|
return new ArtifactDeploymentService(
|
|
_siteRepo, _deploymentRepo, _templateRepo, _externalSystemRepo, _notificationRepo,
|
|
comms, _audit,
|
|
Options.Create(new DeploymentManagerOptions
|
|
{
|
|
ArtifactDeploymentTimeoutPerSite = TimeSpan.FromSeconds(5)
|
|
}),
|
|
logger ?? NullLogger<ArtifactDeploymentService>.Instance,
|
|
_hashService,
|
|
new SiteSecretsCollector(_secretStore));
|
|
}
|
|
|
|
/// <summary>
|
|
/// Captures every formatted log message (and, for entries logged with an exception, the
|
|
/// exception's <see cref="Exception.ToString"/>) so a test can assert on log CONTENT —
|
|
/// specifically, that secret material never appears in it.
|
|
/// </summary>
|
|
private sealed class CapturingLogger<T> : ILogger<T>
|
|
{
|
|
public List<string> Messages { get; } = [];
|
|
|
|
public IDisposable BeginScope<TState>(TState state) where TState : notnull => NullScope.Instance;
|
|
|
|
public bool IsEnabled(LogLevel logLevel) => true;
|
|
|
|
public void Log<TState>(
|
|
LogLevel logLevel, EventId eventId, TState state, Exception? exception,
|
|
Func<TState, Exception?, string> formatter)
|
|
{
|
|
Messages.Add(formatter(state, exception));
|
|
if (exception is not null)
|
|
{
|
|
Messages.Add(exception.ToString());
|
|
}
|
|
}
|
|
|
|
private sealed class NullScope : IDisposable
|
|
{
|
|
public static readonly NullScope Instance = new();
|
|
public void Dispose() { }
|
|
}
|
|
}
|
|
|
|
/// <summary>
|
|
/// Per-test recorder for <see cref="ArtifactProbeActor"/>. DeploymentManager-024:
|
|
/// each test owns its own instance, passed into the actor's constructor, so
|
|
/// the received-command list is no longer shared static state that races
|
|
/// under parallel test execution.
|
|
/// </summary>
|
|
private sealed class ArtifactProbeRecorder
|
|
{
|
|
public readonly ConcurrentBag<DeployArtifactsCommand> Received = new();
|
|
}
|
|
|
|
/// <summary>
|
|
/// Stand-in CentralCommunicationActor for artifact deployment. Records every
|
|
/// <see cref="DeployArtifactsCommand"/> it receives into the per-test
|
|
/// <see cref="ArtifactProbeRecorder"/> and replies success unless the target
|
|
/// site id is in the configured failure set.
|
|
/// </summary>
|
|
private class ArtifactProbeActor : ReceiveActor
|
|
{
|
|
public ArtifactProbeActor(ArtifactProbeRecorder recorder, params string[] failingSites)
|
|
{
|
|
var failSet = new HashSet<string>(failingSites);
|
|
|
|
Receive<SiteEnvelope>(env =>
|
|
{
|
|
if (env.Message is DeployArtifactsCommand cmd)
|
|
{
|
|
recorder.Received.Add(cmd);
|
|
var success = !failSet.Contains(env.SiteId);
|
|
Sender.Tell(new ArtifactDeploymentResponse(
|
|
cmd.DeploymentId, env.SiteId, success,
|
|
success ? null : "site rejected artifacts", DateTimeOffset.UtcNow));
|
|
}
|
|
});
|
|
}
|
|
}
|
|
|
|
/// <summary>
|
|
/// Task 7: stand-in CentralCommunicationActor that always reports the deploy itself as
|
|
/// successful but lets a test control exactly what <see cref="ArtifactDeploymentResponse.SecretsApplied"/>
|
|
/// comes back for a given command — an old site (<c>null</c>), a partial apply (a count
|
|
/// short of what was shipped), or a correct ack (the shipped count) — so the secrets-
|
|
/// reconciliation gate can be exercised independently of the wire-level success/failure
|
|
/// the shared <see cref="ArtifactProbeActor"/> models.
|
|
/// </summary>
|
|
private class SecretsAckProbeActor : ReceiveActor
|
|
{
|
|
public SecretsAckProbeActor(ArtifactProbeRecorder recorder, Func<DeployArtifactsCommand, int?> secretsApplied)
|
|
{
|
|
Receive<SiteEnvelope>(env =>
|
|
{
|
|
if (env.Message is DeployArtifactsCommand cmd)
|
|
{
|
|
recorder.Received.Add(cmd);
|
|
Sender.Tell(new ArtifactDeploymentResponse(
|
|
cmd.DeploymentId, env.SiteId, true, null, DateTimeOffset.UtcNow,
|
|
secretsApplied(cmd)));
|
|
}
|
|
});
|
|
}
|
|
}
|
|
}
|