Joseph Doherty
9a87d7a328
Second slice of the 2026-09-09 whole-system review remediation
(docs/plans/2026-09-09-arch-review.md §10), on top of the High slice 146a1323.
Runtime/devices: SR-2 alarm on-trigger integration scope; SR-3 correlated NativeAlarmActor
subscribe retry; SR-4 immutable audited DB target; SR-5 ordered InstanceActor stop/flush;
SR-12 rehydration fence; SR-13 S&F gate recheck per delivery; DC-4 no OPC UA security
downgrade; DC-5 alarm snapshot for every new subscriber; ORCH-1 sync-dispose joins the pump.
Management/UI: MG-2 site scope on audit tree + Flow Debugger Replay; MG-3 stale-probe memo
removed; MG-4 server-owned bulk-deploy deadline; UI-5 sandbox runs in a killable child
process (new CentralUI.SandboxWorker project); UI-14 bounded sandbox output/IPC.
Edge/audit: EI-1 relay audit ownership; EI-2 SkipBodyCapture suppresses error text; EI-3/EI-11
error-field redaction + caps; EI-4 single relay deadline, pre-execution-only retry; EI-5
authenticated relay provenance; EI-10 body cap before audit read.
Persistence/contracts: DL-1 global Instance.UniqueName unique index + conflict translation;
DL-2 DataConnection protocol config encrypted at rest (migration
20260909203046_EnforceGlobalInstanceNamesAndProtectProtocolConfiguration — coordinated
central upgrade, old binaries cannot read protected rows); DL-3 bounded Replay paging;
DL-6 cross-site Overwrite of a deployed instance rejected; XC-4 proto descriptor contract test.
Config/hygiene: XC-1 central listener isolation by local port; XC-2/XC-3 inert SMTP + cron
keys removed from rig settings; CM-2 env2 bootstrap guard enabled; DC-6 deploy site exit code;
DC-7 notifier retries only explicit standby rejection; XC-5 ClusterClient purged from docs.
Gates recorded in the report: build 0/0, 9 397 passed / 0 failed, rig redeployed on all
eight nodes with the migration applied. 46 Low findings remain open.
42 lines
2.1 KiB
C#
42 lines
2.1 KiB
C#
namespace ZB.MOM.WW.ScadaBridge.AuditLog.Configuration;
|
|
|
|
/// <summary>
|
|
/// Per-target redaction override applied additively on top of
|
|
/// <see cref="AuditLogOptions.GlobalBodyRedactors"/> and the
|
|
/// <see cref="AuditLogOptions.DefaultCapBytes"/> / <see cref="AuditLogOptions.ErrorCapBytes"/>
|
|
/// caps. Targets are identified by the script-facing external-system /
|
|
/// database / notification-list / inbound-API-key name.
|
|
/// </summary>
|
|
public sealed class PerTargetRedactionOverride
|
|
{
|
|
/// <summary>Optional payload cap override (bytes); null inherits the global cap.</summary>
|
|
public int? CapBytes { get; set; }
|
|
|
|
/// <summary>Additional body redactor regex patterns (appended to the global list).</summary>
|
|
public List<string>? AdditionalBodyRedactors { get; set; }
|
|
|
|
/// <summary>
|
|
/// Opt-in SQL parameter redaction: case-insensitive regex matched against
|
|
/// each SQL parameter NAME in the <c>AuditingDbCommand</c> RequestSummary
|
|
/// JSON (<c>{"sql":"...","parameters":{"@name":"value", ...}}</c>); values
|
|
/// whose name matches are replaced with <c><redacted></c>. Null (the
|
|
/// default) means parameter values are captured verbatim. Only applied to
|
|
/// <see cref="ZB.MOM.WW.ScadaBridge.Commons.Types.Enums.AuditChannel.DbOutbound"/>
|
|
/// rows. When configured, free-text SQL errors are suppressed because they can echo
|
|
/// sensitive parameter values without their names.
|
|
/// </summary>
|
|
public string? RedactSqlParamsMatching { get; set; }
|
|
|
|
/// <summary>
|
|
/// When <c>true</c>, the inbound API audit row for this target records
|
|
/// request/response headers and metadata (status, duration, actor, etc.)
|
|
/// but the request and response body strings are omitted
|
|
/// (<c>RequestSummary</c> / <c>ResponseSummary</c> are left null). The
|
|
/// audit row itself is still emitted; exception message/detail are also suppressed
|
|
/// because failures may quote body values.
|
|
/// The default <c>false</c> means body capture
|
|
/// proceeds normally up to <see cref="AuditLogOptions.InboundMaxBytes"/>.
|
|
/// </summary>
|
|
public bool SkipBodyCapture { get; set; }
|
|
}
|