test: prove peer provenance and repeated alarm authority with baseline scope oracle

2026-11-10 12:50:19 -05:00
parent b9a03b4274
commit 47a29dee2b
4 changed files with 273 additions and 9 deletions
@@ -0,0 +1,44 @@
+// Deliberately compiled only in a temporary SDK1.5 baseline integration checkout; never in the candidate solution.
+using Opc.Ua;
+using Opc.Ua.Client;
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Commons.OpcUa;
+using ZB.MOM.WW.OtOpcUa.Configuration.Entities;
+using ZB.MOM.WW.OtOpcUa.Configuration.Enums;
+using static ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.ServerEventRig;
+
+namespace ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests;
+
+public sealed class BaselineScriptedScopeProbe
+{
+    [Fact]
+    public async Task Opaque_scripted_ID_is_denied_by_its_equipment_grant_but_allowed_by_a_cluster_grant()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        await using var rig = await StartAsync("BaselineScriptedScope", encrypted: false, ct);
+        rig.KeyRoles = [];
+        const NodePermissions permissions = NodePermissions.ReadOnly | NodePermissions.AlarmAcknowledge | NodePermissions.MethodCall;
+        rig.Enforce(true, [Key()], new NodeAcl
+        {
+            NodeAclId = "narrow", ClusterId = ServerEventRig.Cluster, Principal = KeyPrincipal,
+            ScopeKind = NodeAclScopeKind.Equipment, ScopeId = $"eq-{EqA}", PermissionFlags = permissions,
+        });
+        rig.MaterialiseScripted();
+        var routed = 0;
+        rig.Nm.AlarmCommandRouter = _ => routed++;
+        using var session = await rig.ConnectAsync(anonymous: false, ct);
+        rig.Project(false, new AlarmConditionSnapshot(true, true, true, true, AlarmShelvingKind.Unshelved, 500, "scope"));
+        var condition = rig.Nm.TryGetAlarmCondition(ScriptedAlarmId, AddressSpaceRealm.Uns).ShouldNotBeNull();
+        var eventId = condition.EventId.ShouldNotBeNull().Value;
+        var denied = await Should.ThrowAsync<ServiceResultException>(() => session.CallAsync(condition.NodeId,
+            MethodIds.AcknowledgeableConditionType_Acknowledge, ct, new object[] { eventId, new LocalizedText("denied") }));
+        denied.StatusCode.ShouldBe(StatusCodes.BadUserAccessDenied);
+        routed.ShouldBe(0);
+        rig.Enforce(true, [Key()], ClusterGrant(KeyPrincipal, "cluster-positive", permissions));
+        await session.CallAsync(condition.NodeId, MethodIds.AcknowledgeableConditionType_Acknowledge, ct,
+            new object[] { eventId, new LocalizedText("allowed") });
+        routed.ShouldBe(1);
+        await session.CloseAsync(ct);
+    }
+}