fix(mesh): stop reporting override-keyed clusters as REVOKED (lmxopcua#784)

The docker-dev centrals logged "Mesh PSK secret ot-mesh-psk-<cluster> ... is absent (or blank) in the store; the key is REVOKED" for every cluster on every contact refresh, while every gRPC dispatch and ack authenticated. Investigated: not an auth bypass. The rig supplies each cluster's key through MeshTransport:ClusterPsks (central side, equal to that cluster's nodes' MeshTransport:GrpcPsk) and seeds nothing in the store. TryGetPsk/Matches consult the override first on every call, so enforcement was on; only RefreshAsync read the store for those clusters regardless and logged a revocation that never took effect. RefreshAsync now skips clusters covered by a non-blank override, so the REVOKED warning is only logged for a cluster that genuinely has no key. Test pins it with a positive control (a cluster with no override is still read, warned about and refused) and enforcement on the override key (wrong token rejected). Mutation-checked: removing the skip fails the test. Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV
2026-11-09 21:13:56 -05:00
parent d9b95dcf56
commit 43f61eba2e
3 changed files with 78 additions and 1 deletions
@@ -345,7 +345,31 @@ public sealed class MeshPskProvider : IMeshPskProvider
        ArgumentNullException.ThrowIfNull(clusterIds);

        var previous = _refreshed;
-        var ids = clusterIds.Where(id => !string.IsNullOrWhiteSpace(id)).Distinct(StringComparer.OrdinalIgnoreCase).ToList();
+
+        // lmxopcua#784: a cluster whose key comes from the MeshTransport:ClusterPsks override is never
+        // served from the store (TryGetPsk consults the override first, on every call), so reading the
+        // store for it is pointless — and reporting "absent in the store; the key is REVOKED" for it is
+        // false: its commands and acks ARE authenticated, against the override key. The docker-dev rig
+        // supplies every cluster's key this way and logged that warning for all three on every contact
+        // refresh while every dispatch and ack authenticated. Skip those clusters here so the REVOKED
+        // warning is only ever logged for a cluster that genuinely has no key.
+        var overrides = _options.Value.ClusterPsks;
+        var all = clusterIds.Where(id => !string.IsNullOrWhiteSpace(id)).Distinct(StringComparer.OrdinalIgnoreCase).ToList();
+        var ids = new List<string>(all.Count);
+        foreach (var id in all)
+        {
+            if (overrides.TryGetValue(id, out var configured) && !string.IsNullOrWhiteSpace(configured))
+            {
+                _logger.LogDebug(
+                    "Mesh PSK for cluster {ClusterId} is supplied by MeshTransport:ClusterPsks; the store is not "
+                    + "consulted and commands to / acks from that cluster are authenticated against that key.",
+                    id);
+                continue;
+            }
+
+            ids.Add(id);
+        }
+
        var results = new ConcurrentDictionary<string, StoreRead>(StringComparer.OrdinalIgnoreCase);

        // Bounded fan-out; each read bounded like the synchronous path.