From 2aa42f90eb55f354d5a099c9c7a2bdcd6b709ad7 Mon Sep 17 00:00:00 2001 From: Joseph Doherty Date: Sat, 1 Aug 2026 09:43:40 -0400 Subject: [PATCH] fix(security): the ACL startup warning described stage 5's scope, not stage 6's MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit It told the operator "Read, Browse and Subscribe remain ungated" — which stage 6 is precisely the change to. A warning that misstates what a security control does is worse than no warning, because it is read as authoritative. Claude-Session: https://claude.ai/code/session_015p7wGqy3YpZNCpDzTpGMKo --- .../OpcUa/OtOpcUaServerHostedService.cs | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/Server/ZB.MOM.WW.OtOpcUa.Host/OpcUa/OtOpcUaServerHostedService.cs b/src/Server/ZB.MOM.WW.OtOpcUa.Host/OpcUa/OtOpcUaServerHostedService.cs index e5760e43..d05d5abf 100644 --- a/src/Server/ZB.MOM.WW.OtOpcUa.Host/OpcUa/OtOpcUaServerHostedService.cs +++ b/src/Server/ZB.MOM.WW.OtOpcUa.Host/OpcUa/OtOpcUaServerHostedService.cs @@ -243,8 +243,9 @@ public sealed class OtOpcUaServerHostedService : IHostedService, IAsyncDisposabl if (_dataPlaneAuthorizer is { Enabled: true }) { _logger.LogWarning( - "OtOpcUaServerHostedService: node ACL enforcement is ENABLED — writes, alarm commands and " - + "HistoryRead now require a matching NodeAcl grant. Read, Browse and Subscribe remain ungated."); + "OtOpcUaServerHostedService: node ACL enforcement is ENABLED — EVERY data-plane operation " + + "(read, browse, subscribe, write, alarm commands, HistoryRead) now requires a matching " + + "NodeAcl grant. A principal with no grant can connect and see nothing."); } // Propagate the configured tie-cluster over-fetch bound onto the node manager so HistoryRead-Raw