Merge #848 #849 #850 credential name claim/pin, env: per-instance rule, merged preflight

2026-11-11 06:36:06 -05:00
parent 8755cf84bb ea156265a2
commit 26349320df
17 changed files with 958 additions and 85 deletions
@@ -372,7 +372,11 @@ host logger factory (wired in `DriverFactoryBootstrap`; the FOCAS and TwinCAT fa
  (case-insensitive; another-instance match beats an own-name match) is refused at save (`DriverConfigSaveGate.ValidateAsync`),
  deploy (`CredentialReferenceOtherInstance`), Test Connect (`TestDriverConnect.DriverInstanceId`) and browse
  (`OpenAsync(…, driverInstanceId, …)`; no ConfigDb ⇒ fail closed). One rule: `DriverCredentialPolicy.DescribeOtherInstanceProblems`
-  + `DriverInstanceIdentities`. The runtime adds no check (drivers don't know the fleet); `env:` is not instance-scoped.
+  + `DriverInstanceIdentities`. The runtime adds no check (drivers don't know the fleet). Since #849 `env:<PREFIX><INSTANCE>_…`
+  is instance-scoped the same way (INSTANCE = id/name upper-cased, other chars `_`; `_`-bounded prefix match); an id-shaped
+  part (`DRV_<12 HEX>`, `secret:…/DRV-<12 hex>/`) matches by id only, and id-shaped names (`drv`, `DRV-<12 hex>…`) are
+  refused. #848: create/rename refuse a name another driver's stored reference uses, and a rename away from a name the
+  driver's own references use (`DescribeNameChangeProblemsAsync`).
  ⚠️ Test Connect/browse configs can carry UNSAVED edits: the claimed owner counts only when every endpoint value
  (`DriverCredentialRules.EndpointFields`) is one that driver stores (`EffectiveOwnerAsync`, server-side) — a new
  credential-sending driver must declare its endpoint keys there. Credential-carrying Test Connect/browse is audited