dohertj2/lmxopcua
1
0
Fork 0
Code Issues 12 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

test(mesh-phase4): pin driver-only ConfigDb-free DI graph + fused-node mapper ordering

Browse Source 
Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW
This commit is contained in:
Joseph Doherty
2026-07-23 13:10:42 -04:00
parent 4253d20248
commit 6f21213f70
1 changed files with 115 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/Server/ZB.MOM.WW.OtOpcUa.Host.IntegrationTests/DriverOnlyNoConfigDbBootTests.cs
+115
View File
@@ -2,9 +2,15 @@ using Microsoft.AspNetCore.Builder;
using Microsoft.EntityFrameworkCore;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.DependencyInjection.Extensions;
using Shouldly;
using Xunit;
using ZB.MOM.WW.Auth.Abstractions.Roles;
using ZB.MOM.WW.Configuration;
using ZB.MOM.WW.OtOpcUa.Configuration;
using ZB.MOM.WW.OtOpcUa.Configuration.Services;
using ZB.MOM.WW.OtOpcUa.Host.Configuration;
using ZB.MOM.WW.OtOpcUa.Security.Ldap;
namespace ZB.MOM.WW.OtOpcUa.Host.IntegrationTests;
@@ -87,6 +93,115 @@ public sealed class DriverOnlyNoConfigDbBootTests : IDisposable
Should.Throw<InvalidOperationException>(() => builder.Services.AddOtOpcUaConfigDb(builder.Configuration));
}
/// <summary>
/// Replicates Program.cs's role-mapping DI ordering, top to bottom:
/// <list type="number">
/// <item><description>
/// the <c>hasAdmin</c> block — <c>AddOtOpcUaConfigDb</c>, which plain-<c>AddScoped</c>s
/// the real <see cref="LdapGroupRoleMappingService"/> (line ~132 in Program.cs);
/// </description></item>
/// <item><description>
/// <c>AddValidatedOptions&lt;LdapOptions, LdapOptionsValidator&gt;</c>, registered
/// unconditionally for every role shape (line ~143);
/// </description></item>
/// <item><description>
/// the <c>hasDriver</c> block's three <c>TryAdd</c> registrations (lines ~333-335):
/// <see cref="NullLdapGroupRoleMappingService"/>, <see cref="OtOpcUaGroupRoleMapper"/>.
/// </description></item>
/// </list>
/// On a FUSED node this ordering is exactly what lets the real EF-backed service win the
/// <c>TryAdd</c> — a plain <c>AddScoped</c> that ran first already claimed the descriptor slot,
/// so the later <c>TryAddScoped</c> is a no-op. Nothing enforces that order beyond Program.cs's
/// own top-to-bottom script. Verified by locally inverting the ordering to (3)-then-(1) AND
/// switching <c>AddOtOpcUaConfigDb</c>'s <c>ILdapGroupRoleMappingService</c> registration to a
/// <c>TryAddScoped</c> (both reverted before commit) — that combination is what flips the
/// resolved type to <see cref="NullLdapGroupRoleMappingService"/> and turns this test red;
/// either change alone stays green today (an unconditional <c>AddScoped</c> always wins
/// last-registered regardless of order, and a <c>TryAdd</c> that runs first still wins). Security:
/// Ldap:Enabled is forced false here purely so <see cref="LdapOptionsValidator"/> doesn't demand
/// a live Server/SearchBase/Transport — it is orthogonal to what is under test.
/// </summary>
private IServiceProvider BuildRoleMappingGraph(bool hasAdmin, string? configDbConnectionString)
{
var builder = WebApplication.CreateBuilder(new WebApplicationOptions { Args = [] });
var config = new Dictionary<string, string?> { ["Security:Ldap:Enabled"] = "false" };
if (configDbConnectionString is not null)
config["ConnectionStrings:ConfigDb"] = configDbConnectionString;
builder.Configuration.AddInMemoryCollection(config);
// (1) hasAdmin block.
if (hasAdmin)
builder.Services.AddOtOpcUaConfigDb(builder.Configuration);
// (2) unconditional for every role shape.
builder.Services.AddValidatedOptions<LdapOptions, LdapOptionsValidator>(
builder.Configuration, LdapOptions.SectionName);
// (3) hasDriver block's TryAdd registrations — runs AFTER (1), never before it.
builder.Services.TryAddScoped<ILdapGroupRoleMappingService, NullLdapGroupRoleMappingService>();
builder.Services.TryAddScoped<IGroupRoleMapper<string>, OtOpcUaGroupRoleMapper>();
var app = builder.Build();
_apps.Add(app);
return app.Services;
}
[Fact]
public void FusedNode_RealLdapGroupRoleMappingService_WinsOverTheDriverBlockTryAdd()
{
// The Task 1b review gap: on a fused admin+driver node, AddOtOpcUaConfigDb's plain AddScoped
// registers the real EF-backed service BEFORE the hasDriver block's TryAddScoped runs, so the
// TryAdd is a no-op and the real service wins. If AddOtOpcUaConfigDb's registration were ever
// switched to a TryAdd, or the two blocks reordered, this flips to NullLdapGroupRoleMappingService
// and every DB-backed role grant central relies on silently stops applying — with no other test
// catching it.
var sp = BuildRoleMappingGraph(
hasAdmin: true,
configDbConnectionString: "Server=(local);Database=OtOpcUa;Trusted_Connection=True;TrustServerCertificate=True");
using var scope = sp.CreateScope();
scope.ServiceProvider.GetRequiredService<ILdapGroupRoleMappingService>()
.ShouldBeOfType<LdapGroupRoleMappingService>();
}
[Fact]
public void DriverOnlyNode_LdapGroupRoleMapping_ResolvesTheNullImpl_AndNoConfigDbFactory()
{
// The other half of the same pin: with no hasAdmin block ever run, the driver block's TryAdd
// is the ONLY registration, so it wins by default — no ConfigDb, no real EF service reachable.
var sp = BuildRoleMappingGraph(hasAdmin: false, configDbConnectionString: null);
sp.GetService<IDbContextFactory<OtOpcUaConfigDbContext>>().ShouldBeNull();
using var scope = sp.CreateScope();
scope.ServiceProvider.GetRequiredService<ILdapGroupRoleMappingService>()
.ShouldBeOfType<NullLdapGroupRoleMappingService>();
}
[Fact]
public async Task DriverOnlyNode_IGroupRoleMapper_ResolvesInScope_AndMapsWithoutThrowing()
{
// Task 1b fixed a lazy auth-path break: IGroupRoleMapper<string> depends on
// ILdapGroupRoleMappingService, which a driver-only node never registered before that fix —
// the DI graph built fine (nothing eager touches it), and the break surfaced only on the first
// SCOPED resolve + call, deep in the OPC UA data-plane authenticator. A bare Build() cannot
// catch that class of bug; this test resolves in a scope and calls MapAsync, mirroring the
// real call site.
var sp = BuildRoleMappingGraph(hasAdmin: false, configDbConnectionString: null);
using var scope = sp.CreateScope();
var mapper = scope.ServiceProvider.GetRequiredService<IGroupRoleMapper<string>>();
mapper.ShouldBeOfType<OtOpcUaGroupRoleMapper>();
scope.ServiceProvider.GetRequiredService<ILdapGroupRoleMappingService>()
.ShouldBeOfType<NullLdapGroupRoleMappingService>();
GroupRoleMapping<string> result = null!;
await Should.NotThrowAsync(async () => result = await mapper.MapAsync(["some-group"], CancellationToken.None));
result.ShouldNotBeNull();
result.Scope.ShouldBeNull();
}
public void Dispose()
{
foreach (var app in _apps)