fix(controlplane): validate and compose a deployment from ONE snapshot read
StartDeployment read the whole config DB twice with no transaction — DraftSnapshotFactory for the validator, then ConfigComposer for the artifact, plus clusters/nodes and Script.SourceCode again in between. An AdminUI save landing between the two shipped an artifact the DraftValidator never saw. - DraftSnapshot carries ServerClusters, ClusterNodes and ApiKeys; DraftSnapshotFactory reads every table inside one SNAPSHOT transaction on a relational provider (no-op on InMemory or under an ambient transaction). - ConfigComposer.Compose(DraftSnapshot) is pure over the snapshot (ordinal-sorted keys); SnapshotAndFlattenAsync(db) delegates to it, byte-identical. - AdminOperationsActor validates topology, estimates compile cost and composes the artifact from the one snapshot it holds. - Migration EnableSnapshotIsolation: ALTER DATABASE CURRENT SET ALLOW_SNAPSHOT_ISOLATION ON (suppressTransaction; no model change). Tests: the SQL Server snapshot read ignores a row committed mid-read (positive control: a later read sees it); an edit injected between the Equipment and Tags reads is absent from the shipped artifact and rejected by the next deploy; Compose(snapshot) == SnapshotAndFlattenAsync(db). Refs #733 Claude-Session: https://claude.ai/code/session_01Ub9hGmYLQvn9XETzw7CMsT
This commit is contained in:
Joseph Doherty
+1618
File diff suppressed because it is too large
Load Diff
+36
@@ -0,0 +1,36 @@
|
||||
using Microsoft.EntityFrameworkCore.Migrations;
|
||||
|
||||
#nullable disable
|
||||
|
||||
namespace ZB.MOM.WW.OtOpcUa.Configuration.Migrations
|
||||
{
|
||||
/// <summary>
|
||||
/// Enables <c>ALLOW_SNAPSHOT_ISOLATION</c> on the config database so the deploy path can read every
|
||||
/// table inside one <c>SNAPSHOT</c> transaction (<c>DraftSnapshotFactory.FromConfigDbAsync</c>):
|
||||
/// the validator and the artifact composer then see one consistent state instead of two reads
|
||||
/// an AdminUI save can land between. No schema change — the model snapshot is untouched.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// <c>ALTER DATABASE</c> cannot run inside the user transaction the migrator wraps each migration in,
|
||||
/// hence <c>suppressTransaction: true</c>. Turning the option ON does not need exclusive access (unlike
|
||||
/// <c>READ_COMMITTED_SNAPSHOT</c>); it waits for in-flight transactions and then takes effect. Down
|
||||
/// leaves it ON: a database that has run with it is not harmed by keeping it, and switching it OFF
|
||||
/// would fail any deploy running at that instant.
|
||||
/// </remarks>
|
||||
public partial class EnableSnapshotIsolation : Migration
|
||||
{
|
||||
/// <inheritdoc />
|
||||
protected override void Up(MigrationBuilder migrationBuilder)
|
||||
{
|
||||
migrationBuilder.Sql(
|
||||
"ALTER DATABASE CURRENT SET ALLOW_SNAPSHOT_ISOLATION ON;",
|
||||
suppressTransaction: true);
|
||||
}
|
||||
|
||||
/// <inheritdoc />
|
||||
protected override void Down(MigrationBuilder migrationBuilder)
|
||||
{
|
||||
// Deliberately a no-op; see the class remarks.
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -66,6 +66,23 @@ public sealed class DraftSnapshot
|
||||
/// silently dropped when the permission trie is built, so the grant has to be caught here instead.</summary>
|
||||
public IReadOnlyList<NodeAcl> NodeAcls { get; init; } = [];
|
||||
|
||||
/// <summary>
|
||||
/// Cluster rows. Not read by the row-level rules; carried so the deploy path validates the cluster
|
||||
/// topology (<see cref="DraftValidator.ValidateClusterTopology"/>) and composes the artifact from
|
||||
/// the SAME read as every other table — a second read between validate and compose is exactly how
|
||||
/// an edit ships unvalidated.
|
||||
/// </summary>
|
||||
public IReadOnlyList<ServerCluster> ServerClusters { get; init; } = [];
|
||||
|
||||
/// <summary>Cluster-node rows; see <see cref="ServerClusters"/> for why they ride the snapshot.</summary>
|
||||
public IReadOnlyList<ClusterNode> ClusterNodes { get; init; } = [];
|
||||
|
||||
/// <summary>
|
||||
/// Data-plane API keys (peppered HMAC only, never a secret). Not validated; carried so the artifact
|
||||
/// composer ships the keys a driver-only node authenticates against from the one consistent read.
|
||||
/// </summary>
|
||||
public IReadOnlyList<ApiKey> ApiKeys { get; init; } = [];
|
||||
|
||||
/// <summary>Prior Equipment rows (any generation, same cluster) for stability checks.</summary>
|
||||
public IReadOnlyList<Equipment> PriorEquipment { get; init; } = [];
|
||||
|
||||
|
||||
@@ -1,3 +1,4 @@
|
||||
using System.Data;
|
||||
using Microsoft.EntityFrameworkCore;
|
||||
|
||||
namespace ZB.MOM.WW.OtOpcUa.Configuration.Validation;
|
||||
@@ -21,6 +22,16 @@ namespace ZB.MOM.WW.OtOpcUa.Configuration.Validation;
|
||||
/// / <see cref="DraftSnapshot.Site"/> are left null so the path-length rule uses its
|
||||
/// conservative upper bound.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// <b>One consistent read.</b> On a relational provider the tables are read inside a
|
||||
/// <see cref="IsolationLevel.Snapshot"/> transaction, so a <c>/uns</c> or <c>/raw</c> save that
|
||||
/// lands mid-read cannot leave half the tables on the new state and half on the old. The deploy path
|
||||
/// validates AND composes its artifact from this one snapshot, which is what makes "the artifact the
|
||||
/// validator never saw" unrepresentable. SQL Server requires <c>ALLOW_SNAPSHOT_ISOLATION ON</c>
|
||||
/// (migration <c>EnableSnapshotIsolation</c>); without it the first query fails with error 3952 and
|
||||
/// the deploy is rejected rather than silently read unisolated. A non-relational provider (the
|
||||
/// InMemory test provider) and a context already inside a transaction read without one.
|
||||
/// </para>
|
||||
/// </remarks>
|
||||
public static class DraftSnapshotFactory
|
||||
{
|
||||
@@ -29,6 +40,23 @@ public static class DraftSnapshotFactory
|
||||
/// <param name="ct">Cancellation token.</param>
|
||||
/// <returns>A snapshot populated from the live DB, ready for <see cref="DraftValidator.Validate"/>.</returns>
|
||||
public static async Task<DraftSnapshot> FromConfigDbAsync(OtOpcUaConfigDbContext db, CancellationToken ct = default)
|
||||
{
|
||||
ArgumentNullException.ThrowIfNull(db);
|
||||
|
||||
var ownsTransaction = db.Database.IsRelational() && db.Database.CurrentTransaction is null;
|
||||
var tx = ownsTransaction
|
||||
? await db.Database.BeginTransactionAsync(IsolationLevel.Snapshot, ct).ConfigureAwait(false)
|
||||
: null;
|
||||
await using (tx)
|
||||
{
|
||||
var snapshot = await ReadAsync(db, ct).ConfigureAwait(false);
|
||||
// Read-only: committing releases the snapshot's version-store reservation; nothing was written.
|
||||
if (tx is not null) await tx.CommitAsync(ct).ConfigureAwait(false);
|
||||
return snapshot;
|
||||
}
|
||||
}
|
||||
|
||||
private static async Task<DraftSnapshot> ReadAsync(OtOpcUaConfigDbContext db, CancellationToken ct)
|
||||
=> new DraftSnapshot
|
||||
{
|
||||
// GenerationId=0 and null Enterprise/Site are intentional conservative fallbacks at the
|
||||
@@ -36,6 +64,8 @@ public static class DraftSnapshotFactory
|
||||
// EquipmentUuid checks run in separate validator passes — no rule here reads these fields.
|
||||
GenerationId = 0, // generation model dropped; placeholder (no rule reads it)
|
||||
ClusterId = string.Empty, // global snapshot; rules compare entity ClusterId fields, not this
|
||||
ServerClusters = await db.ServerClusters.AsNoTracking().ToListAsync(ct),
|
||||
ClusterNodes = await db.ClusterNodes.AsNoTracking().ToListAsync(ct),
|
||||
// v3: Namespace entity retired — no namespace list to materialize. The Raw tree
|
||||
// (RawFolders/TagGroups) + UnsTagReferences feed the v3 rules (charset, tagname length,
|
||||
// effective-leaf uniqueness).
|
||||
@@ -53,6 +83,7 @@ public static class DraftSnapshotFactory
|
||||
Scripts = await db.Scripts.AsNoTracking().ToListAsync(ct),
|
||||
PollGroups = await db.PollGroups.AsNoTracking().ToListAsync(ct),
|
||||
NodeAcls = await db.NodeAcls.AsNoTracking().ToListAsync(ct),
|
||||
ApiKeys = await db.ApiKeys.AsNoTracking().ToListAsync(ct),
|
||||
PriorEquipment = [], // intentional: no prior-generation table to diff against at this level
|
||||
ActiveReservations = await db.ExternalIdReservations
|
||||
.AsNoTracking()
|
||||
|
||||
@@ -223,18 +223,14 @@ public sealed class AdminOperationsActor : ReceiveActor
|
||||
// pair on the row itself, but it cannot see the per-node ClusterNode.Enabled flag — an
|
||||
// operator can disable a node (effective enabled-count = 1) while leaving RedundancyMode at
|
||||
// Hot/Warm and the constraint stays green, which would boot the runtime into an
|
||||
// InvalidTopology band. ValidateClusterTopology catches that drift, but it isn't carried on
|
||||
// the generation-versioned DraftSnapshot (the cluster/node rows aren't versioned), so it must
|
||||
// be run separately here against the live rows. Read-only (AsNoTracking); errors fold into the
|
||||
// same reject summary alongside the snapshot rules so a deploy failing either check is
|
||||
// rejected with both sets of messages. ClusterId-ordered for a deterministic summary.
|
||||
var clusters = await db.ServerClusters
|
||||
.AsNoTracking()
|
||||
.OrderBy(c => c.ClusterId)
|
||||
.ToListAsync();
|
||||
var nodesByCluster = (await db.ClusterNodes
|
||||
.AsNoTracking()
|
||||
.ToListAsync())
|
||||
// InvalidTopology band. ValidateClusterTopology catches that drift; it is not part of
|
||||
// DraftValidator.Validate, so it runs separately here over the snapshot's cluster/node rows.
|
||||
// Errors fold into the same reject summary alongside the snapshot rules so a deploy failing
|
||||
// either check is rejected with both sets of messages. ClusterId-ordered for a deterministic summary.
|
||||
// R03:3.2 — both come off the SAME snapshot read as every other table (one SNAPSHOT
|
||||
// transaction), not a second query that could observe a later edit.
|
||||
var clusters = draft.ServerClusters.OrderBy(c => c.ClusterId, StringComparer.Ordinal).ToList();
|
||||
var nodesByCluster = draft.ClusterNodes
|
||||
.GroupBy(n => n.ClusterId, StringComparer.Ordinal)
|
||||
.ToDictionary(g => g.Key, g => g.ToList(), StringComparer.Ordinal);
|
||||
foreach (var cluster in clusters)
|
||||
@@ -310,8 +306,9 @@ public sealed class AdminOperationsActor : ReceiveActor
|
||||
try
|
||||
{
|
||||
const double PerScriptMiB = 1.66; // measured post-A0 per-script RSS (design doc 2026-06-07)
|
||||
var scriptSources = await db.Scripts.AsNoTracking().Select(s => s.SourceCode).ToListAsync();
|
||||
var compiled = scriptSources
|
||||
// Projected from the snapshot already in hand — Script.SourceCode used to be read three times.
|
||||
var compiled = draft.Scripts
|
||||
.Select(s => s.SourceCode)
|
||||
.Where(src => !PassthroughScript.TryMatch(src, out _))
|
||||
.Distinct(StringComparer.Ordinal)
|
||||
.Count();
|
||||
@@ -331,7 +328,9 @@ public sealed class AdminOperationsActor : ReceiveActor
|
||||
advisory = null;
|
||||
}
|
||||
|
||||
var artifact = await ConfigComposer.SnapshotAndFlattenAsync(db);
|
||||
// Composed from the validated snapshot, never from a second read: an edit that lands between
|
||||
// validation and here is simply not in this artifact (R03:3.2).
|
||||
var artifact = ConfigComposer.Compose(draft);
|
||||
var deploymentId = DeploymentId.NewId();
|
||||
var revHash = RevisionHash.Parse(artifact.RevisionHash);
|
||||
|
||||
|
||||
@@ -1,9 +1,8 @@
|
||||
using System.IO.Compression;
|
||||
using System.Security.Cryptography;
|
||||
using System.Text.Json;
|
||||
using Microsoft.EntityFrameworkCore;
|
||||
using ZB.MOM.WW.OtOpcUa.Configuration;
|
||||
using ZB.MOM.WW.OtOpcUa.Configuration.Entities;
|
||||
using ZB.MOM.WW.OtOpcUa.Configuration.Validation;
|
||||
|
||||
namespace ZB.MOM.WW.OtOpcUa.ControlPlane.AdminOperations;
|
||||
|
||||
@@ -25,45 +24,65 @@ public static class ConfigComposer
|
||||
};
|
||||
|
||||
/// <summary>Reads the current configuration and returns a deterministic snapshot blob with revision hash.</summary>
|
||||
/// <remarks>
|
||||
/// One consistent read (<see cref="DraftSnapshotFactory.FromConfigDbAsync"/>, a SNAPSHOT transaction on
|
||||
/// SQL Server) handed to <see cref="Compose"/>. The deploy path does not call this: it validates and
|
||||
/// composes from the one <see cref="DraftSnapshot"/> it already holds, so nothing can land between the
|
||||
/// validator's read and the composer's. This overload serves the drift probe and tests.
|
||||
/// </remarks>
|
||||
/// <param name="db">The configuration database context.</param>
|
||||
/// <param name="ct">The cancellation token for the operation.</param>
|
||||
/// <returns>A deterministic <see cref="ConfigArtifact"/> containing the serialised snapshot bytes and its revision hash.</returns>
|
||||
public static async Task<ConfigArtifact> SnapshotAndFlattenAsync(
|
||||
OtOpcUaConfigDbContext db, CancellationToken ct = default)
|
||||
=> Compose(await DraftSnapshotFactory.FromConfigDbAsync(db, ct).ConfigureAwait(false));
|
||||
|
||||
/// <summary>
|
||||
/// Serialises an already-read <see cref="DraftSnapshot"/> into the deterministic artifact. Pure over
|
||||
/// its input: the same snapshot always yields the same bytes and hash, whatever the DB holds by now.
|
||||
/// </summary>
|
||||
/// <param name="snapshot">The rows to compose — the SAME rows the validator was run over.</param>
|
||||
/// <returns>The compressed artifact blob and its revision hash.</returns>
|
||||
public static ConfigArtifact Compose(DraftSnapshot snapshot)
|
||||
{
|
||||
ArgumentNullException.ThrowIfNull(snapshot);
|
||||
|
||||
// v3 greenfield snapshot: the Raw tree (RawFolders → DriverInstances(+RawFolderId) → Devices(+DeviceConfig)
|
||||
// → TagGroups → Tags(DeviceId/TagGroupId, no EquipmentId/FolderPath/DriverInstanceId)) plus the UNS
|
||||
// projection (UnsAreas/UnsLines/Equipment/UnsTagReferences) and the retained VirtualTags/ScriptedAlarms/
|
||||
// PollGroups/NodeAcls/Scripts. The Namespaces snapshot is RETIRED (the two OPC UA namespaces are implicit).
|
||||
// RevisionHash inputs follow the blob automatically — adding/removing a table shifts the SHA-256.
|
||||
var snapshot = new
|
||||
// Every collection is sorted by its natural key with an ORDINAL comparer so the hash is independent of
|
||||
// both EF row order and the process culture (a culture-aware sort could order "a-1"/"A-1" differently
|
||||
// on two central nodes and make the same config hash twice).
|
||||
var ordered = new
|
||||
{
|
||||
Clusters = await db.ServerClusters.AsNoTracking().OrderBy(x => x.ClusterId).ToListAsync(ct),
|
||||
Nodes = await db.ClusterNodes.AsNoTracking().OrderBy(x => x.NodeId).ToListAsync(ct),
|
||||
RawFolders = await db.RawFolders.AsNoTracking().OrderBy(x => x.RawFolderId).ToListAsync(ct),
|
||||
DriverInstances = await db.DriverInstances.AsNoTracking().OrderBy(x => x.DriverInstanceId).ToListAsync(ct),
|
||||
Devices = await db.Devices.AsNoTracking().OrderBy(x => x.DeviceId).ToListAsync(ct),
|
||||
TagGroups = await db.TagGroups.AsNoTracking().OrderBy(x => x.TagGroupId).ToListAsync(ct),
|
||||
Equipment = await db.Equipment.AsNoTracking().OrderBy(x => x.EquipmentId).ToListAsync(ct),
|
||||
Tags = await db.Tags.AsNoTracking().OrderBy(x => x.TagId).ToListAsync(ct),
|
||||
UnsTagReferences = await db.UnsTagReferences.AsNoTracking().OrderBy(x => x.UnsTagReferenceId).ToListAsync(ct),
|
||||
PollGroups = await db.PollGroups.AsNoTracking().OrderBy(x => x.PollGroupId).ToListAsync(ct),
|
||||
UnsAreas = await db.UnsAreas.AsNoTracking().OrderBy(x => x.UnsAreaId).ToListAsync(ct),
|
||||
UnsLines = await db.UnsLines.AsNoTracking().OrderBy(x => x.UnsLineId).ToListAsync(ct),
|
||||
NodeAcls = await db.NodeAcls.AsNoTracking().OrderBy(x => x.NodeAclId).ToListAsync(ct),
|
||||
Clusters = snapshot.ServerClusters.OrderBy(x => x.ClusterId, StringComparer.Ordinal).ToList(),
|
||||
Nodes = snapshot.ClusterNodes.OrderBy(x => x.NodeId, StringComparer.Ordinal).ToList(),
|
||||
RawFolders = snapshot.RawFolders.OrderBy(x => x.RawFolderId, StringComparer.Ordinal).ToList(),
|
||||
DriverInstances = snapshot.DriverInstances.OrderBy(x => x.DriverInstanceId, StringComparer.Ordinal).ToList(),
|
||||
Devices = snapshot.Devices.OrderBy(x => x.DeviceId, StringComparer.Ordinal).ToList(),
|
||||
TagGroups = snapshot.TagGroups.OrderBy(x => x.TagGroupId, StringComparer.Ordinal).ToList(),
|
||||
Equipment = snapshot.Equipment.OrderBy(x => x.EquipmentId, StringComparer.Ordinal).ToList(),
|
||||
Tags = snapshot.Tags.OrderBy(x => x.TagId, StringComparer.Ordinal).ToList(),
|
||||
UnsTagReferences = snapshot.UnsTagReferences.OrderBy(x => x.UnsTagReferenceId, StringComparer.Ordinal).ToList(),
|
||||
PollGroups = snapshot.PollGroups.OrderBy(x => x.PollGroupId, StringComparer.Ordinal).ToList(),
|
||||
UnsAreas = snapshot.UnsAreas.OrderBy(x => x.UnsAreaId, StringComparer.Ordinal).ToList(),
|
||||
UnsLines = snapshot.UnsLines.OrderBy(x => x.UnsLineId, StringComparer.Ordinal).ToList(),
|
||||
NodeAcls = snapshot.NodeAcls.OrderBy(x => x.NodeAclId, StringComparer.Ordinal).ToList(),
|
||||
// the data-plane credentials travel with the config, because a driver-only node
|
||||
// has no ConfigDb to read them from (per-cluster mesh Phase 4) and would otherwise deny every
|
||||
// UserName token. Only the peppered HMAC of each secret ships — never the secret — and the
|
||||
// pepper is node configuration that is deliberately NOT in the artifact, so a stolen blob
|
||||
// still cannot be turned into a working credential. This is also why revoking a key reaches a
|
||||
// driver-only node only on the next deployment; see the ApiKey entity's remarks.
|
||||
ApiKeys = await db.ApiKeys.AsNoTracking().OrderBy(x => x.ApiKeyId).ToListAsync(ct),
|
||||
Scripts = await db.Scripts.AsNoTracking().OrderBy(x => x.ScriptId).ToListAsync(ct),
|
||||
VirtualTags = await db.VirtualTags.AsNoTracking().OrderBy(x => x.VirtualTagId).ToListAsync(ct),
|
||||
ScriptedAlarms = await db.ScriptedAlarms.AsNoTracking().OrderBy(x => x.ScriptedAlarmId).ToListAsync(ct),
|
||||
ApiKeys = snapshot.ApiKeys.OrderBy(x => x.ApiKeyId, StringComparer.Ordinal).ToList(),
|
||||
Scripts = snapshot.Scripts.OrderBy(x => x.ScriptId, StringComparer.Ordinal).ToList(),
|
||||
VirtualTags = snapshot.VirtualTags.OrderBy(x => x.VirtualTagId, StringComparer.Ordinal).ToList(),
|
||||
ScriptedAlarms = snapshot.ScriptedAlarms.OrderBy(x => x.ScriptedAlarmId, StringComparer.Ordinal).ToList(),
|
||||
};
|
||||
|
||||
return Pack(JsonSerializer.SerializeToUtf8Bytes(snapshot, JsonOptions));
|
||||
return Pack(JsonSerializer.SerializeToUtf8Bytes(ordered, JsonOptions));
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
|
||||
+117
@@ -0,0 +1,117 @@
|
||||
using Microsoft.Data.SqlClient;
|
||||
using Microsoft.EntityFrameworkCore;
|
||||
using Microsoft.EntityFrameworkCore.Diagnostics;
|
||||
using Shouldly;
|
||||
using Xunit;
|
||||
using ZB.MOM.WW.OtOpcUa.Configuration.Entities;
|
||||
using ZB.MOM.WW.OtOpcUa.Configuration.Enums;
|
||||
using ZB.MOM.WW.OtOpcUa.Configuration.Validation;
|
||||
|
||||
namespace ZB.MOM.WW.OtOpcUa.Configuration.Tests;
|
||||
|
||||
/// <summary>
|
||||
/// R03:3.2 on the real provider: the migrated config database allows SNAPSHOT isolation (migration
|
||||
/// <c>EnableSnapshotIsolation</c>) and <see cref="DraftSnapshotFactory.FromConfigDbAsync"/> reads under
|
||||
/// it. The InMemory tests cannot see either — the provider has no transactions — so this is the one
|
||||
/// place the deploy path's "one consistent read" is proven against SQL Server.
|
||||
/// </summary>
|
||||
[Trait("Category", "SchemaCompliance")]
|
||||
[Collection(nameof(SchemaComplianceCollection))]
|
||||
public sealed class DraftSnapshotFactorySqlServerTests
|
||||
{
|
||||
private readonly SchemaComplianceFixture _fixture;
|
||||
|
||||
/// <summary>Initializes a new instance of the <see cref="DraftSnapshotFactorySqlServerTests"/> class.</summary>
|
||||
/// <param name="fixture">The migrated test database.</param>
|
||||
public DraftSnapshotFactorySqlServerTests(SchemaComplianceFixture fixture) => _fixture = fixture;
|
||||
|
||||
/// <summary>The migration leaves the database with snapshot isolation allowed.</summary>
|
||||
[Fact]
|
||||
public void Migrated_database_allows_snapshot_isolation()
|
||||
{
|
||||
using var conn = _fixture.OpenConnection();
|
||||
using var cmd = new SqlCommand(
|
||||
"SELECT snapshot_isolation_state_desc FROM sys.databases WHERE name = DB_NAME();", conn);
|
||||
cmd.ExecuteScalar().ShouldBe("ON");
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// A row committed by another connection while the snapshot read is in progress is NOT observed by
|
||||
/// the tables read after it — every table reflects the instant the transaction started. Positive
|
||||
/// control: a read started after the commit does see the row.
|
||||
/// </summary>
|
||||
[Fact]
|
||||
public async Task FromConfigDb_reads_every_table_as_of_one_instant()
|
||||
{
|
||||
var clusterId = $"SNAP-{Guid.NewGuid():N}"[..24];
|
||||
var scriptId = $"late-{Guid.NewGuid():N}";
|
||||
await using (var seed = NewContext())
|
||||
{
|
||||
seed.ServerClusters.Add(new ServerCluster
|
||||
{
|
||||
ClusterId = clusterId, Name = "snapshot-read", Enterprise = "zb", Site = "test",
|
||||
NodeCount = 1, RedundancyMode = RedundancyMode.None, CreatedBy = "test",
|
||||
});
|
||||
await seed.SaveChangesAsync();
|
||||
}
|
||||
|
||||
try
|
||||
{
|
||||
var options = new DbContextOptionsBuilder<OtOpcUaConfigDbContext>()
|
||||
.UseSqlServer(_fixture.ConnectionString)
|
||||
.AddInterceptors(new LateEditInterceptor(_fixture.ConnectionString, clusterId, scriptId))
|
||||
.Options;
|
||||
|
||||
await using (var db = new OtOpcUaConfigDbContext(options))
|
||||
{
|
||||
var snapshot = await DraftSnapshotFactory.FromConfigDbAsync(db);
|
||||
// The interceptor committed a Script while ServerClusters (the FIRST table read) was being
|
||||
// materialised. Scripts is read later in the same transaction and must not see it.
|
||||
snapshot.ServerClusters.ShouldContain(c => c.ClusterId == clusterId);
|
||||
snapshot.Scripts.ShouldNotContain(s => s.ScriptId == scriptId);
|
||||
}
|
||||
|
||||
await using (var verify = NewContext())
|
||||
{
|
||||
// Positive control: the edit really landed, and a read started afterwards sees it.
|
||||
(await verify.Scripts.AnyAsync(s => s.ScriptId == scriptId)).ShouldBeTrue();
|
||||
var later = await DraftSnapshotFactory.FromConfigDbAsync(verify);
|
||||
later.Scripts.ShouldContain(s => s.ScriptId == scriptId);
|
||||
}
|
||||
}
|
||||
finally
|
||||
{
|
||||
await using var cleanup = NewContext();
|
||||
await cleanup.Scripts.Where(s => s.ScriptId == scriptId).ExecuteDeleteAsync();
|
||||
await cleanup.ServerClusters.Where(c => c.ClusterId == clusterId).ExecuteDeleteAsync();
|
||||
}
|
||||
}
|
||||
|
||||
private OtOpcUaConfigDbContext NewContext() => new(
|
||||
new DbContextOptionsBuilder<OtOpcUaConfigDbContext>().UseSqlServer(_fixture.ConnectionString).Options);
|
||||
|
||||
/// <summary>
|
||||
/// Commits a Script on a SEPARATE connection the first time the snapshot read materialises the
|
||||
/// seeded ServerCluster row — i.e. mid-read, after the first table and before Scripts.
|
||||
/// </summary>
|
||||
private sealed class LateEditInterceptor(string connectionString, string clusterId, string scriptId)
|
||||
: IMaterializationInterceptor
|
||||
{
|
||||
private int _fired;
|
||||
|
||||
public object InitializedInstance(MaterializationInterceptionData materializationData, object entity)
|
||||
{
|
||||
if (entity is ServerCluster c && c.ClusterId == clusterId && Interlocked.Exchange(ref _fired, 1) == 0)
|
||||
{
|
||||
using var other = new OtOpcUaConfigDbContext(
|
||||
new DbContextOptionsBuilder<OtOpcUaConfigDbContext>().UseSqlServer(connectionString).Options);
|
||||
other.Scripts.Add(new Script
|
||||
{
|
||||
ScriptId = scriptId, Name = "late edit", SourceCode = "return 1;", SourceHash = "late-hash",
|
||||
});
|
||||
other.SaveChanges();
|
||||
}
|
||||
return entity;
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -103,6 +103,36 @@ public sealed class DraftSnapshotFactoryTests : IDisposable
|
||||
snapshot.ActiveReservations[0].ReleasedAt.ShouldBeNull();
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// R03:3.2 — the deploy path validates AND composes from ONE snapshot, so the tables the composer
|
||||
/// needs beyond the validator's set (clusters, nodes, API keys) must ride the same read.
|
||||
/// </summary>
|
||||
[Fact]
|
||||
public async Task FromConfigDb_carries_clusters_nodes_and_api_keys_for_the_composer()
|
||||
{
|
||||
_db.ServerClusters.Add(new ServerCluster
|
||||
{
|
||||
ClusterId = "SITE-A", Name = "Site A", Enterprise = "zb", Site = "site-a",
|
||||
NodeCount = 1, RedundancyMode = RedundancyMode.None, CreatedBy = "test",
|
||||
});
|
||||
_db.ClusterNodes.Add(new ClusterNode
|
||||
{
|
||||
NodeId = "site-a-1:4053", ClusterId = "SITE-A", Host = "site-a-1",
|
||||
ApplicationUri = "urn:OtOpcUa:site-a-1", Enabled = true, CreatedBy = "test",
|
||||
});
|
||||
_db.ApiKeys.Add(new ApiKey
|
||||
{
|
||||
ApiKeyId = "k1", Name = "scada", SecretHash = "hash", Principal = "scadabridge", Enabled = true,
|
||||
});
|
||||
await _db.SaveChangesAsync();
|
||||
|
||||
var snapshot = await DraftSnapshotFactory.FromConfigDbAsync(_db);
|
||||
|
||||
snapshot.ServerClusters.ShouldHaveSingleItem().ClusterId.ShouldBe("SITE-A");
|
||||
snapshot.ClusterNodes.ShouldHaveSingleItem().NodeId.ShouldBe("site-a-1:4053");
|
||||
snapshot.ApiKeys.ShouldHaveSingleItem().ApiKeyId.ShouldBe("k1");
|
||||
}
|
||||
|
||||
private void SeedEquipment(string equipmentId)
|
||||
{
|
||||
var uuid = Guid.NewGuid();
|
||||
|
||||
+133
@@ -0,0 +1,133 @@
|
||||
using System.IO.Compression;
|
||||
using System.Text;
|
||||
using Akka.Actor;
|
||||
using Microsoft.EntityFrameworkCore;
|
||||
using Microsoft.EntityFrameworkCore.Diagnostics;
|
||||
using Microsoft.EntityFrameworkCore.Storage;
|
||||
using Shouldly;
|
||||
using Xunit;
|
||||
using ZB.MOM.WW.OtOpcUa.Commons.Messages.Admin;
|
||||
using ZB.MOM.WW.OtOpcUa.Commons.Messages.Deploy;
|
||||
using ZB.MOM.WW.OtOpcUa.Commons.Types;
|
||||
using ZB.MOM.WW.OtOpcUa.Configuration;
|
||||
using ZB.MOM.WW.OtOpcUa.Configuration.Entities;
|
||||
using ZB.MOM.WW.OtOpcUa.Configuration.Enums;
|
||||
using ZB.MOM.WW.OtOpcUa.ControlPlane.AdminOperations;
|
||||
using ZB.MOM.WW.OtOpcUa.ControlPlane.Tests.Harness;
|
||||
using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
|
||||
|
||||
namespace ZB.MOM.WW.OtOpcUa.ControlPlane.Tests;
|
||||
|
||||
/// <summary>
|
||||
/// R03:3.2 — <c>StartDeployment</c> used to read the whole config DB twice: once for the validator,
|
||||
/// once for the composer. An edit landing between the two shipped an artifact the validator never saw.
|
||||
/// The deploy now validates and composes ONE snapshot, so an edit that lands mid-deploy is either
|
||||
/// validated (it was in the snapshot) or absent from the artifact (it was not) — never shipped unseen.
|
||||
/// </summary>
|
||||
public sealed class AdminOperationsActorSingleSnapshotTests : ControlPlaneActorTestBase
|
||||
{
|
||||
private const string LateEquipmentId = "EQ-late-and-NOT-canonical";
|
||||
|
||||
/// <summary>
|
||||
/// An Equipment with a non-canonical id (the validator rejects those with <c>EquipmentIdNotDerived</c>)
|
||||
/// is committed by another context while the snapshot read is in progress, AFTER the Equipment table
|
||||
/// has been read. The validator cannot see it, so the deploy is Accepted — and the artifact must not
|
||||
/// carry it either. Positive control: the row really landed in the DB, and a deploy started after it
|
||||
/// is Rejected on exactly that rule.
|
||||
/// </summary>
|
||||
[Fact]
|
||||
public void Edit_landing_between_validate_and_compose_cannot_ship_unvalidated()
|
||||
{
|
||||
// One shared root: an InMemory store is scoped to the internal service provider, and a context
|
||||
// carrying an interceptor builds its own provider — without the shared root the intercepting
|
||||
// context would read an EMPTY database and the whole test would be vacuous.
|
||||
var dbName = Guid.NewGuid().ToString("N");
|
||||
var root = new InMemoryDatabaseRoot();
|
||||
var plain = new RootedDbFactory(dbName, root, interceptor: null);
|
||||
using (var db = plain.CreateDbContext())
|
||||
{
|
||||
// A Tag to materialise — Tags is read AFTER Equipment by the snapshot factory, so an insert
|
||||
// fired on the first Tag lands "between" the two tables of one read.
|
||||
db.DriverInstances.Add(new DriverInstance
|
||||
{
|
||||
DriverInstanceId = "d", ClusterId = "", Name = "drv", DriverType = "Modbus", DriverConfig = "{}",
|
||||
});
|
||||
db.Devices.Add(new Device { DeviceId = "dev", DriverInstanceId = "d", Name = "dev", DeviceConfig = "{}" });
|
||||
db.Tags.Add(new Tag
|
||||
{
|
||||
TagId = "tag-speed", DeviceId = "dev", Name = "speed", DataType = "Float",
|
||||
AccessLevel = TagAccessLevel.Read, TagConfig = "{}",
|
||||
});
|
||||
db.SaveChanges();
|
||||
}
|
||||
|
||||
var injecting = new RootedDbFactory(dbName, root, new LateEquipmentInterceptor(plain));
|
||||
var coordinator = CreateTestProbe("coord");
|
||||
var actor = Sys.ActorOf(AdminOperationsActor.Props(injecting, coordinator.Ref, Enumerable.Empty<IDriverProbe>()));
|
||||
|
||||
actor.Tell(new StartDeployment("joe", CorrelationId.NewId()));
|
||||
|
||||
var reply = ExpectMsg<StartDeploymentResult>(PresenceBudget);
|
||||
reply.Outcome.ShouldBe(StartDeploymentOutcome.Accepted, reply.Message);
|
||||
coordinator.ExpectMsg<DispatchDeployment>(PresenceBudget);
|
||||
|
||||
using (var verify = plain.CreateDbContext())
|
||||
{
|
||||
// The injection happened...
|
||||
verify.Equipment.Any(e => e.EquipmentId == LateEquipmentId).ShouldBeTrue();
|
||||
// ...and the shipped artifact does not contain what the validator never saw.
|
||||
var row = verify.Deployments.Single();
|
||||
Inflate(row.ArtifactBlob).ShouldNotContain(LateEquipmentId);
|
||||
// The coordinator is a probe here, so seal the row by hand to let the next deploy through.
|
||||
row.Status = DeploymentStatus.Sealed;
|
||||
verify.SaveChanges();
|
||||
}
|
||||
|
||||
// Positive control: now that the row is visible to a fresh read, the gate rejects it.
|
||||
actor.Tell(new StartDeployment("joe", CorrelationId.NewId()));
|
||||
var second = ExpectMsg<StartDeploymentResult>(PresenceBudget);
|
||||
second.Outcome.ShouldBe(StartDeploymentOutcome.Rejected);
|
||||
second.Message.ShouldNotBeNull();
|
||||
second.Message.ShouldContain("EquipmentIdNotDerived");
|
||||
}
|
||||
|
||||
private static string Inflate(byte[] blob)
|
||||
{
|
||||
using var gz = new GZipStream(new MemoryStream(blob), CompressionMode.Decompress);
|
||||
using var reader = new StreamReader(gz, Encoding.UTF8);
|
||||
return reader.ReadToEnd();
|
||||
}
|
||||
|
||||
/// <summary>On the first Tag materialised, commits a non-canonical Equipment through ANOTHER context.</summary>
|
||||
private sealed class LateEquipmentInterceptor(IDbContextFactory<OtOpcUaConfigDbContext> other)
|
||||
: IMaterializationInterceptor
|
||||
{
|
||||
private int _fired;
|
||||
|
||||
public object InitializedInstance(MaterializationInterceptionData materializationData, object entity)
|
||||
{
|
||||
if (entity is Tag && Interlocked.Exchange(ref _fired, 1) == 0)
|
||||
{
|
||||
using var db = other.CreateDbContext();
|
||||
db.Equipment.Add(new Equipment
|
||||
{
|
||||
EquipmentUuid = Guid.NewGuid(), EquipmentId = LateEquipmentId, Name = "late",
|
||||
UnsLineId = "line-a", MachineCode = "m",
|
||||
});
|
||||
db.SaveChanges();
|
||||
}
|
||||
return entity;
|
||||
}
|
||||
}
|
||||
|
||||
private sealed class RootedDbFactory(string dbName, InMemoryDatabaseRoot root, IInterceptor? interceptor)
|
||||
: IDbContextFactory<OtOpcUaConfigDbContext>
|
||||
{
|
||||
public OtOpcUaConfigDbContext CreateDbContext()
|
||||
{
|
||||
var builder = new DbContextOptionsBuilder<OtOpcUaConfigDbContext>().UseInMemoryDatabase(dbName, root);
|
||||
if (interceptor is not null) builder.AddInterceptors(interceptor);
|
||||
return new OtOpcUaConfigDbContext(builder.Options);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -222,6 +222,47 @@ public sealed class ConfigComposerTests : ControlPlaneActorTestBase
|
||||
withoutOverride.ResilienceConfig.ShouldBeNull("an unset override stays null ⇒ tier defaults at spawn");
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// R03:3.2 — the deploy path composes from the <see cref="Configuration.Validation.DraftSnapshot"/> it
|
||||
/// validated rather than re-reading the DB. <see cref="ConfigComposer.Compose"/> over the factory's
|
||||
/// snapshot must therefore be byte-identical to the DB overload, or the drift probe (which still
|
||||
/// uses the DB overload) would report every deployment as drifted.
|
||||
/// </summary>
|
||||
[Fact]
|
||||
public async Task Compose_over_the_factory_snapshot_is_byte_identical_to_the_db_overload()
|
||||
{
|
||||
var f = NewInMemoryDbFactory();
|
||||
await using (var db = f.CreateDbContext())
|
||||
{
|
||||
db.ServerClusters.Add(NewCluster("cluster-b"));
|
||||
db.ServerClusters.Add(NewCluster("cluster-a"));
|
||||
db.ApiKeys.Add(new ApiKey
|
||||
{
|
||||
ApiKeyId = "k1", Name = "scada", SecretHash = "h", Principal = "scadabridge", CreatedUtc = FixedTimestamp,
|
||||
});
|
||||
db.Scripts.Add(new Script { ScriptId = "s-1", Name = "s", SourceCode = "return 1;", SourceHash = "x" });
|
||||
await db.SaveChangesAsync();
|
||||
}
|
||||
|
||||
var viaDb = await ConfigComposer.SnapshotAndFlattenAsync(f.CreateDbContext());
|
||||
var snapshot = await Configuration.Validation.DraftSnapshotFactory.FromConfigDbAsync(f.CreateDbContext());
|
||||
var viaSnapshot = ConfigComposer.Compose(snapshot);
|
||||
|
||||
viaSnapshot.RevisionHash.ShouldBe(viaDb.RevisionHash);
|
||||
viaSnapshot.Blob.ShouldBe(viaDb.Blob);
|
||||
// The composed content is the snapshot's, not something re-read: the keys and clusters are in it.
|
||||
var json = Inflate(viaSnapshot.Blob);
|
||||
json.ShouldContain("\"ApiKeyId\":\"k1\"");
|
||||
json.IndexOf("cluster-a", StringComparison.Ordinal).ShouldBeLessThan(json.IndexOf("cluster-b", StringComparison.Ordinal));
|
||||
}
|
||||
|
||||
private static string Inflate(byte[] blob)
|
||||
{
|
||||
using var gz = new GZipStream(new MemoryStream(blob), CompressionMode.Decompress);
|
||||
using var reader = new StreamReader(gz, Encoding.UTF8);
|
||||
return reader.ReadToEnd();
|
||||
}
|
||||
|
||||
private static readonly DateTime FixedTimestamp = new(2026, 1, 1, 0, 0, 0, DateTimeKind.Utc);
|
||||
|
||||
private static ServerCluster NewCluster(string id) => new()
|
||||
|
||||
Reference in New Issue
Block a user