feat(host): hard wall-clock bound + bounded concurrency on OPC UA LDAP authentication (03/S2)

src/Server/ZB.MOM.WW.OtOpcUa.Host/OpcUa/LdapOpcUaUserAuthenticator.cs

@@ -1,5 +1,6 @@
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
 using ZB.MOM.WW.Auth.Abstractions.Roles;
 using ZB.MOM.WW.OtOpcUa.OpcUaServer.Security;
 using ZB.MOM.WW.OtOpcUa.Security.Ldap;
@@ -16,22 +17,108 @@ namespace ZB.MOM.WW.OtOpcUa.Host.OpcUa;
 /// session identity for the downstream data-plane ACL evaluator.
 /// </summary>
 /// <remarks>
+/// <para>
 /// This authenticator is registered as a singleton, but <see cref="IGroupRoleMapper{TRole}"/>
 /// (and its DbContext-backed mapping service) is scoped. A per-call DI scope is opened to
 /// resolve the mapper so the singleton never captures a scoped dependency.
+/// </para>
+/// <para>
+/// <b>Resilience (arch-review 03/S2).</b> The OPC UA SDK raises the impersonation callback that
+/// reaches here <em>synchronously</em>, inside a <c>SessionManager</c>-wide event lock (verified
+/// against <c>OPCFoundation.NetStandard.Opc.Ua.Server</c> 1.5.378 —
+/// <c>SessionManager.ActivateSessionAsync</c> holds <c>m_eventLock</c> while invoking the
+/// <c>void</c> impersonation delegate). A slow / hung LDAP bind inside that callback therefore does
+/// not merely stall one SDK thread — it serializes <em>every</em> session activation server-wide
+/// (Anonymous and X509 included). The callback contract is irreducibly synchronous (there is no
+/// async impersonation callback), so the fix lives entirely at this boundary: a hard whole-flow
+/// wall-clock bound (<see cref="LdapOptions.AuthTimeoutMs"/>) and a bounded in-flight concurrency cap
+/// (<see cref="LdapOptions.MaxConcurrentAuthentications"/>), both fail-closed. All new paths deny.
+/// </para>
 /// </remarks>
-public sealed class LdapOpcUaUserAuthenticator(
-    ILdapAuthService ldap,
-    IServiceScopeFactory scopeFactory,
-    ILogger<LdapOpcUaUserAuthenticator> logger)
-    : IOpcUaUserAuthenticator
+public sealed class LdapOpcUaUserAuthenticator : IOpcUaUserAuthenticator
 {
+    private readonly ILdapAuthService _ldap;
+    private readonly IServiceScopeFactory _scopeFactory;
+    private readonly ILogger<LdapOpcUaUserAuthenticator> _logger;
+    private readonly LdapOptions _options;
+
+    /// <summary>Bounds in-flight authentication flows. A boundary timeout abandons its core task, which
+    /// keeps holding its slot until it actually completes — so an outage cannot accumulate unbounded
+    /// orphan binds.</summary>
+    private readonly SemaphoreSlim _gate;
+
+    /// <summary>Constructs the authenticator from its dependencies and the bound LDAP options.</summary>
+    /// <param name="ldap">The app LDAP auth service (shared with the Admin UI login flow).</param>
+    /// <param name="scopeFactory">Opens a per-call DI scope to resolve the scoped role mapper.</param>
+    /// <param name="options">The bound <see cref="LdapOptions"/> (timeout + concurrency knobs).</param>
+    /// <param name="logger">The logger.</param>
+    public LdapOpcUaUserAuthenticator(
+        ILdapAuthService ldap,
+        IServiceScopeFactory scopeFactory,
+        IOptions<LdapOptions> options,
+        ILogger<LdapOpcUaUserAuthenticator> logger)
+    {
+        _ldap = ldap;
+        _scopeFactory = scopeFactory;
+        _options = options.Value;
+        _logger = logger;
+        _gate = new SemaphoreSlim(Math.Max(1, _options.MaxConcurrentAuthentications));
+    }
+
     /// <inheritdoc />
     public async Task<OpcUaUserAuthResult> AuthenticateUserNameAsync(string username, string password, CancellationToken ct)
     {
+        var authTimeout = TimeSpan.FromMilliseconds(Math.Max(1, _options.AuthTimeoutMs));
+
+        // Bounded in-flight concurrency: acquire a slot within our own wall-clock budget. All slots
+        // busy is LOCAL backpressure, not directory evidence — deny "busy" (fail-closed).
+        if (!await _gate.WaitAsync(authTimeout, ct).ConfigureAwait(false))
+        {
+            _logger.LogWarning(
+                "LDAP authentication backend busy (concurrency cap {Cap}) — denying OPC UA user {User}",
+                _options.MaxConcurrentAuthentications, username);
+            return OpcUaUserAuthResult.Deny("Authentication backend busy");
+        }
+
+        // Release the slot when the CORE task completes — deliberately NOT in a finally here. A boundary
+        // timeout below abandons the core task (it runs to completion in the background; the underlying
+        // library is documented never-throw, so there are no unobserved exceptions), and it must keep
+        // counting against the cap until it finishes. The point of the boundary is to release the SDK
+        // thread (and m_eventLock), not to cancel the bind.
+        var core = AuthenticateCoreAsync(username, password, ct);
+        _ = core.ContinueWith(
+            static (_, state) => ((SemaphoreSlim)state!).Release(),
+            _gate,
+            CancellationToken.None,
+            TaskContinuationOptions.None,
+            TaskScheduler.Default);
+
         try
         {
-            var result = await ldap.AuthenticateAsync(username, password, ct).ConfigureAwait(false);
+            return await core.WaitAsync(authTimeout, ct).ConfigureAwait(false);
+        }
+        catch (TimeoutException)
+        {
+            _logger.LogWarning(
+                "LDAP authentication timed out after {Timeout} for OPC UA user {User} — denying (fail-closed)",
+                authTimeout, username);
+            return OpcUaUserAuthResult.Deny("Authentication timed out");
+        }
+    }
+
+    /// <summary>
+    /// The unbounded core authenticate flow (bind + role-map) that the outer
+    /// <see cref="AuthenticateUserNameAsync"/> wraps in a wall-clock bound + concurrency cap. Fail-closed:
+    /// any backend throw becomes a denial rather than escaping into the SDK.
+    /// </summary>
+    /// <param name="username">The username to authenticate.</param>
+    /// <param name="password">The cleartext password.</param>
+    /// <param name="ct">Cancellation token.</param>
+    private async Task<OpcUaUserAuthResult> AuthenticateCoreAsync(string username, string password, CancellationToken ct)
+    {
+        try
+        {
+            var result = await _ldap.AuthenticateAsync(username, password, ct).ConfigureAwait(false);
             if (!result.Success)
             {
                 return OpcUaUserAuthResult.Deny(result.Error ?? "Invalid credentials");
@@ -42,7 +129,7 @@ public sealed class LdapOpcUaUserAuthenticator(
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
-            logger.LogWarning(ex, "LDAP authentication threw for OPC UA user {User}", username);
+            _logger.LogWarning(ex, "LDAP authentication threw for OPC UA user {User}", username);
             return OpcUaUserAuthResult.Deny("Authentication backend error");
         }
     }
@@ -62,7 +149,7 @@ public sealed class LdapOpcUaUserAuthenticator(
     {
         try
         {
-            await using var scope = scopeFactory.CreateAsyncScope();
+            await using var scope = _scopeFactory.CreateAsyncScope();
             var mapper = scope.ServiceProvider.GetRequiredService<IGroupRoleMapper<string>>();
             var mapping = await mapper.MapAsync(groups, ct).ConfigureAwait(false);
 
@@ -73,7 +160,7 @@ public sealed class LdapOpcUaUserAuthenticator(
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
-            logger.LogWarning(ex,
+            _logger.LogWarning(ex,
                 "Role-map lookup failed for OPC UA user {User}; using pre-resolved baseline roles", username);
             return preResolved;
         }