fix(controlplane): validate and compose a deployment from ONE snapshot read
StartDeployment read the whole config DB twice with no transaction — DraftSnapshotFactory for the validator, then ConfigComposer for the artifact, plus clusters/nodes and Script.SourceCode again in between. An AdminUI save landing between the two shipped an artifact the DraftValidator never saw. - DraftSnapshot carries ServerClusters, ClusterNodes and ApiKeys; DraftSnapshotFactory reads every table inside one SNAPSHOT transaction on a relational provider (no-op on InMemory or under an ambient transaction). - ConfigComposer.Compose(DraftSnapshot) is pure over the snapshot (ordinal-sorted keys); SnapshotAndFlattenAsync(db) delegates to it, byte-identical. - AdminOperationsActor validates topology, estimates compile cost and composes the artifact from the one snapshot it holds. - Migration EnableSnapshotIsolation: ALTER DATABASE CURRENT SET ALLOW_SNAPSHOT_ISOLATION ON (suppressTransaction; no model change). Tests: the SQL Server snapshot read ignores a row committed mid-read (positive control: a later read sees it); an edit injected between the Equipment and Tags reads is absent from the shipped artifact and rejected by the next deploy; Compose(snapshot) == SnapshotAndFlattenAsync(db). Refs #733 Claude-Session: https://claude.ai/code/session_01Ub9hGmYLQvn9XETzw7CMsT
This commit is contained in:
Joseph Doherty
+1618
File diff suppressed because it is too large
Load Diff
+36
@@ -0,0 +1,36 @@
|
||||
using Microsoft.EntityFrameworkCore.Migrations;
|
||||
|
||||
#nullable disable
|
||||
|
||||
namespace ZB.MOM.WW.OtOpcUa.Configuration.Migrations
|
||||
{
|
||||
/// <summary>
|
||||
/// Enables <c>ALLOW_SNAPSHOT_ISOLATION</c> on the config database so the deploy path can read every
|
||||
/// table inside one <c>SNAPSHOT</c> transaction (<c>DraftSnapshotFactory.FromConfigDbAsync</c>):
|
||||
/// the validator and the artifact composer then see one consistent state instead of two reads
|
||||
/// an AdminUI save can land between. No schema change — the model snapshot is untouched.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// <c>ALTER DATABASE</c> cannot run inside the user transaction the migrator wraps each migration in,
|
||||
/// hence <c>suppressTransaction: true</c>. Turning the option ON does not need exclusive access (unlike
|
||||
/// <c>READ_COMMITTED_SNAPSHOT</c>); it waits for in-flight transactions and then takes effect. Down
|
||||
/// leaves it ON: a database that has run with it is not harmed by keeping it, and switching it OFF
|
||||
/// would fail any deploy running at that instant.
|
||||
/// </remarks>
|
||||
public partial class EnableSnapshotIsolation : Migration
|
||||
{
|
||||
/// <inheritdoc />
|
||||
protected override void Up(MigrationBuilder migrationBuilder)
|
||||
{
|
||||
migrationBuilder.Sql(
|
||||
"ALTER DATABASE CURRENT SET ALLOW_SNAPSHOT_ISOLATION ON;",
|
||||
suppressTransaction: true);
|
||||
}
|
||||
|
||||
/// <inheritdoc />
|
||||
protected override void Down(MigrationBuilder migrationBuilder)
|
||||
{
|
||||
// Deliberately a no-op; see the class remarks.
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -66,6 +66,23 @@ public sealed class DraftSnapshot
|
||||
/// silently dropped when the permission trie is built, so the grant has to be caught here instead.</summary>
|
||||
public IReadOnlyList<NodeAcl> NodeAcls { get; init; } = [];
|
||||
|
||||
/// <summary>
|
||||
/// Cluster rows. Not read by the row-level rules; carried so the deploy path validates the cluster
|
||||
/// topology (<see cref="DraftValidator.ValidateClusterTopology"/>) and composes the artifact from
|
||||
/// the SAME read as every other table — a second read between validate and compose is exactly how
|
||||
/// an edit ships unvalidated.
|
||||
/// </summary>
|
||||
public IReadOnlyList<ServerCluster> ServerClusters { get; init; } = [];
|
||||
|
||||
/// <summary>Cluster-node rows; see <see cref="ServerClusters"/> for why they ride the snapshot.</summary>
|
||||
public IReadOnlyList<ClusterNode> ClusterNodes { get; init; } = [];
|
||||
|
||||
/// <summary>
|
||||
/// Data-plane API keys (peppered HMAC only, never a secret). Not validated; carried so the artifact
|
||||
/// composer ships the keys a driver-only node authenticates against from the one consistent read.
|
||||
/// </summary>
|
||||
public IReadOnlyList<ApiKey> ApiKeys { get; init; } = [];
|
||||
|
||||
/// <summary>Prior Equipment rows (any generation, same cluster) for stability checks.</summary>
|
||||
public IReadOnlyList<Equipment> PriorEquipment { get; init; } = [];
|
||||
|
||||
|
||||
@@ -1,3 +1,4 @@
|
||||
using System.Data;
|
||||
using Microsoft.EntityFrameworkCore;
|
||||
|
||||
namespace ZB.MOM.WW.OtOpcUa.Configuration.Validation;
|
||||
@@ -21,6 +22,16 @@ namespace ZB.MOM.WW.OtOpcUa.Configuration.Validation;
|
||||
/// / <see cref="DraftSnapshot.Site"/> are left null so the path-length rule uses its
|
||||
/// conservative upper bound.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// <b>One consistent read.</b> On a relational provider the tables are read inside a
|
||||
/// <see cref="IsolationLevel.Snapshot"/> transaction, so a <c>/uns</c> or <c>/raw</c> save that
|
||||
/// lands mid-read cannot leave half the tables on the new state and half on the old. The deploy path
|
||||
/// validates AND composes its artifact from this one snapshot, which is what makes "the artifact the
|
||||
/// validator never saw" unrepresentable. SQL Server requires <c>ALLOW_SNAPSHOT_ISOLATION ON</c>
|
||||
/// (migration <c>EnableSnapshotIsolation</c>); without it the first query fails with error 3952 and
|
||||
/// the deploy is rejected rather than silently read unisolated. A non-relational provider (the
|
||||
/// InMemory test provider) and a context already inside a transaction read without one.
|
||||
/// </para>
|
||||
/// </remarks>
|
||||
public static class DraftSnapshotFactory
|
||||
{
|
||||
@@ -29,6 +40,23 @@ public static class DraftSnapshotFactory
|
||||
/// <param name="ct">Cancellation token.</param>
|
||||
/// <returns>A snapshot populated from the live DB, ready for <see cref="DraftValidator.Validate"/>.</returns>
|
||||
public static async Task<DraftSnapshot> FromConfigDbAsync(OtOpcUaConfigDbContext db, CancellationToken ct = default)
|
||||
{
|
||||
ArgumentNullException.ThrowIfNull(db);
|
||||
|
||||
var ownsTransaction = db.Database.IsRelational() && db.Database.CurrentTransaction is null;
|
||||
var tx = ownsTransaction
|
||||
? await db.Database.BeginTransactionAsync(IsolationLevel.Snapshot, ct).ConfigureAwait(false)
|
||||
: null;
|
||||
await using (tx)
|
||||
{
|
||||
var snapshot = await ReadAsync(db, ct).ConfigureAwait(false);
|
||||
// Read-only: committing releases the snapshot's version-store reservation; nothing was written.
|
||||
if (tx is not null) await tx.CommitAsync(ct).ConfigureAwait(false);
|
||||
return snapshot;
|
||||
}
|
||||
}
|
||||
|
||||
private static async Task<DraftSnapshot> ReadAsync(OtOpcUaConfigDbContext db, CancellationToken ct)
|
||||
=> new DraftSnapshot
|
||||
{
|
||||
// GenerationId=0 and null Enterprise/Site are intentional conservative fallbacks at the
|
||||
@@ -36,6 +64,8 @@ public static class DraftSnapshotFactory
|
||||
// EquipmentUuid checks run in separate validator passes — no rule here reads these fields.
|
||||
GenerationId = 0, // generation model dropped; placeholder (no rule reads it)
|
||||
ClusterId = string.Empty, // global snapshot; rules compare entity ClusterId fields, not this
|
||||
ServerClusters = await db.ServerClusters.AsNoTracking().ToListAsync(ct),
|
||||
ClusterNodes = await db.ClusterNodes.AsNoTracking().ToListAsync(ct),
|
||||
// v3: Namespace entity retired — no namespace list to materialize. The Raw tree
|
||||
// (RawFolders/TagGroups) + UnsTagReferences feed the v3 rules (charset, tagname length,
|
||||
// effective-leaf uniqueness).
|
||||
@@ -53,6 +83,7 @@ public static class DraftSnapshotFactory
|
||||
Scripts = await db.Scripts.AsNoTracking().ToListAsync(ct),
|
||||
PollGroups = await db.PollGroups.AsNoTracking().ToListAsync(ct),
|
||||
NodeAcls = await db.NodeAcls.AsNoTracking().ToListAsync(ct),
|
||||
ApiKeys = await db.ApiKeys.AsNoTracking().ToListAsync(ct),
|
||||
PriorEquipment = [], // intentional: no prior-generation table to diff against at this level
|
||||
ActiveReservations = await db.ExternalIdReservations
|
||||
.AsNoTracking()
|
||||
|
||||
@@ -223,18 +223,14 @@ public sealed class AdminOperationsActor : ReceiveActor
|
||||
// pair on the row itself, but it cannot see the per-node ClusterNode.Enabled flag — an
|
||||
// operator can disable a node (effective enabled-count = 1) while leaving RedundancyMode at
|
||||
// Hot/Warm and the constraint stays green, which would boot the runtime into an
|
||||
// InvalidTopology band. ValidateClusterTopology catches that drift, but it isn't carried on
|
||||
// the generation-versioned DraftSnapshot (the cluster/node rows aren't versioned), so it must
|
||||
// be run separately here against the live rows. Read-only (AsNoTracking); errors fold into the
|
||||
// same reject summary alongside the snapshot rules so a deploy failing either check is
|
||||
// rejected with both sets of messages. ClusterId-ordered for a deterministic summary.
|
||||
var clusters = await db.ServerClusters
|
||||
.AsNoTracking()
|
||||
.OrderBy(c => c.ClusterId)
|
||||
.ToListAsync();
|
||||
var nodesByCluster = (await db.ClusterNodes
|
||||
.AsNoTracking()
|
||||
.ToListAsync())
|
||||
// InvalidTopology band. ValidateClusterTopology catches that drift; it is not part of
|
||||
// DraftValidator.Validate, so it runs separately here over the snapshot's cluster/node rows.
|
||||
// Errors fold into the same reject summary alongside the snapshot rules so a deploy failing
|
||||
// either check is rejected with both sets of messages. ClusterId-ordered for a deterministic summary.
|
||||
// R03:3.2 — both come off the SAME snapshot read as every other table (one SNAPSHOT
|
||||
// transaction), not a second query that could observe a later edit.
|
||||
var clusters = draft.ServerClusters.OrderBy(c => c.ClusterId, StringComparer.Ordinal).ToList();
|
||||
var nodesByCluster = draft.ClusterNodes
|
||||
.GroupBy(n => n.ClusterId, StringComparer.Ordinal)
|
||||
.ToDictionary(g => g.Key, g => g.ToList(), StringComparer.Ordinal);
|
||||
foreach (var cluster in clusters)
|
||||
@@ -310,8 +306,9 @@ public sealed class AdminOperationsActor : ReceiveActor
|
||||
try
|
||||
{
|
||||
const double PerScriptMiB = 1.66; // measured post-A0 per-script RSS (design doc 2026-06-07)
|
||||
var scriptSources = await db.Scripts.AsNoTracking().Select(s => s.SourceCode).ToListAsync();
|
||||
var compiled = scriptSources
|
||||
// Projected from the snapshot already in hand — Script.SourceCode used to be read three times.
|
||||
var compiled = draft.Scripts
|
||||
.Select(s => s.SourceCode)
|
||||
.Where(src => !PassthroughScript.TryMatch(src, out _))
|
||||
.Distinct(StringComparer.Ordinal)
|
||||
.Count();
|
||||
@@ -331,7 +328,9 @@ public sealed class AdminOperationsActor : ReceiveActor
|
||||
advisory = null;
|
||||
}
|
||||
|
||||
var artifact = await ConfigComposer.SnapshotAndFlattenAsync(db);
|
||||
// Composed from the validated snapshot, never from a second read: an edit that lands between
|
||||
// validation and here is simply not in this artifact (R03:3.2).
|
||||
var artifact = ConfigComposer.Compose(draft);
|
||||
var deploymentId = DeploymentId.NewId();
|
||||
var revHash = RevisionHash.Parse(artifact.RevisionHash);
|
||||
|
||||
|
||||
@@ -1,9 +1,8 @@
|
||||
using System.IO.Compression;
|
||||
using System.Security.Cryptography;
|
||||
using System.Text.Json;
|
||||
using Microsoft.EntityFrameworkCore;
|
||||
using ZB.MOM.WW.OtOpcUa.Configuration;
|
||||
using ZB.MOM.WW.OtOpcUa.Configuration.Entities;
|
||||
using ZB.MOM.WW.OtOpcUa.Configuration.Validation;
|
||||
|
||||
namespace ZB.MOM.WW.OtOpcUa.ControlPlane.AdminOperations;
|
||||
|
||||
@@ -25,45 +24,65 @@ public static class ConfigComposer
|
||||
};
|
||||
|
||||
/// <summary>Reads the current configuration and returns a deterministic snapshot blob with revision hash.</summary>
|
||||
/// <remarks>
|
||||
/// One consistent read (<see cref="DraftSnapshotFactory.FromConfigDbAsync"/>, a SNAPSHOT transaction on
|
||||
/// SQL Server) handed to <see cref="Compose"/>. The deploy path does not call this: it validates and
|
||||
/// composes from the one <see cref="DraftSnapshot"/> it already holds, so nothing can land between the
|
||||
/// validator's read and the composer's. This overload serves the drift probe and tests.
|
||||
/// </remarks>
|
||||
/// <param name="db">The configuration database context.</param>
|
||||
/// <param name="ct">The cancellation token for the operation.</param>
|
||||
/// <returns>A deterministic <see cref="ConfigArtifact"/> containing the serialised snapshot bytes and its revision hash.</returns>
|
||||
public static async Task<ConfigArtifact> SnapshotAndFlattenAsync(
|
||||
OtOpcUaConfigDbContext db, CancellationToken ct = default)
|
||||
=> Compose(await DraftSnapshotFactory.FromConfigDbAsync(db, ct).ConfigureAwait(false));
|
||||
|
||||
/// <summary>
|
||||
/// Serialises an already-read <see cref="DraftSnapshot"/> into the deterministic artifact. Pure over
|
||||
/// its input: the same snapshot always yields the same bytes and hash, whatever the DB holds by now.
|
||||
/// </summary>
|
||||
/// <param name="snapshot">The rows to compose — the SAME rows the validator was run over.</param>
|
||||
/// <returns>The compressed artifact blob and its revision hash.</returns>
|
||||
public static ConfigArtifact Compose(DraftSnapshot snapshot)
|
||||
{
|
||||
ArgumentNullException.ThrowIfNull(snapshot);
|
||||
|
||||
// v3 greenfield snapshot: the Raw tree (RawFolders → DriverInstances(+RawFolderId) → Devices(+DeviceConfig)
|
||||
// → TagGroups → Tags(DeviceId/TagGroupId, no EquipmentId/FolderPath/DriverInstanceId)) plus the UNS
|
||||
// projection (UnsAreas/UnsLines/Equipment/UnsTagReferences) and the retained VirtualTags/ScriptedAlarms/
|
||||
// PollGroups/NodeAcls/Scripts. The Namespaces snapshot is RETIRED (the two OPC UA namespaces are implicit).
|
||||
// RevisionHash inputs follow the blob automatically — adding/removing a table shifts the SHA-256.
|
||||
var snapshot = new
|
||||
// Every collection is sorted by its natural key with an ORDINAL comparer so the hash is independent of
|
||||
// both EF row order and the process culture (a culture-aware sort could order "a-1"/"A-1" differently
|
||||
// on two central nodes and make the same config hash twice).
|
||||
var ordered = new
|
||||
{
|
||||
Clusters = await db.ServerClusters.AsNoTracking().OrderBy(x => x.ClusterId).ToListAsync(ct),
|
||||
Nodes = await db.ClusterNodes.AsNoTracking().OrderBy(x => x.NodeId).ToListAsync(ct),
|
||||
RawFolders = await db.RawFolders.AsNoTracking().OrderBy(x => x.RawFolderId).ToListAsync(ct),
|
||||
DriverInstances = await db.DriverInstances.AsNoTracking().OrderBy(x => x.DriverInstanceId).ToListAsync(ct),
|
||||
Devices = await db.Devices.AsNoTracking().OrderBy(x => x.DeviceId).ToListAsync(ct),
|
||||
TagGroups = await db.TagGroups.AsNoTracking().OrderBy(x => x.TagGroupId).ToListAsync(ct),
|
||||
Equipment = await db.Equipment.AsNoTracking().OrderBy(x => x.EquipmentId).ToListAsync(ct),
|
||||
Tags = await db.Tags.AsNoTracking().OrderBy(x => x.TagId).ToListAsync(ct),
|
||||
UnsTagReferences = await db.UnsTagReferences.AsNoTracking().OrderBy(x => x.UnsTagReferenceId).ToListAsync(ct),
|
||||
PollGroups = await db.PollGroups.AsNoTracking().OrderBy(x => x.PollGroupId).ToListAsync(ct),
|
||||
UnsAreas = await db.UnsAreas.AsNoTracking().OrderBy(x => x.UnsAreaId).ToListAsync(ct),
|
||||
UnsLines = await db.UnsLines.AsNoTracking().OrderBy(x => x.UnsLineId).ToListAsync(ct),
|
||||
NodeAcls = await db.NodeAcls.AsNoTracking().OrderBy(x => x.NodeAclId).ToListAsync(ct),
|
||||
Clusters = snapshot.ServerClusters.OrderBy(x => x.ClusterId, StringComparer.Ordinal).ToList(),
|
||||
Nodes = snapshot.ClusterNodes.OrderBy(x => x.NodeId, StringComparer.Ordinal).ToList(),
|
||||
RawFolders = snapshot.RawFolders.OrderBy(x => x.RawFolderId, StringComparer.Ordinal).ToList(),
|
||||
DriverInstances = snapshot.DriverInstances.OrderBy(x => x.DriverInstanceId, StringComparer.Ordinal).ToList(),
|
||||
Devices = snapshot.Devices.OrderBy(x => x.DeviceId, StringComparer.Ordinal).ToList(),
|
||||
TagGroups = snapshot.TagGroups.OrderBy(x => x.TagGroupId, StringComparer.Ordinal).ToList(),
|
||||
Equipment = snapshot.Equipment.OrderBy(x => x.EquipmentId, StringComparer.Ordinal).ToList(),
|
||||
Tags = snapshot.Tags.OrderBy(x => x.TagId, StringComparer.Ordinal).ToList(),
|
||||
UnsTagReferences = snapshot.UnsTagReferences.OrderBy(x => x.UnsTagReferenceId, StringComparer.Ordinal).ToList(),
|
||||
PollGroups = snapshot.PollGroups.OrderBy(x => x.PollGroupId, StringComparer.Ordinal).ToList(),
|
||||
UnsAreas = snapshot.UnsAreas.OrderBy(x => x.UnsAreaId, StringComparer.Ordinal).ToList(),
|
||||
UnsLines = snapshot.UnsLines.OrderBy(x => x.UnsLineId, StringComparer.Ordinal).ToList(),
|
||||
NodeAcls = snapshot.NodeAcls.OrderBy(x => x.NodeAclId, StringComparer.Ordinal).ToList(),
|
||||
// the data-plane credentials travel with the config, because a driver-only node
|
||||
// has no ConfigDb to read them from (per-cluster mesh Phase 4) and would otherwise deny every
|
||||
// UserName token. Only the peppered HMAC of each secret ships — never the secret — and the
|
||||
// pepper is node configuration that is deliberately NOT in the artifact, so a stolen blob
|
||||
// still cannot be turned into a working credential. This is also why revoking a key reaches a
|
||||
// driver-only node only on the next deployment; see the ApiKey entity's remarks.
|
||||
ApiKeys = await db.ApiKeys.AsNoTracking().OrderBy(x => x.ApiKeyId).ToListAsync(ct),
|
||||
Scripts = await db.Scripts.AsNoTracking().OrderBy(x => x.ScriptId).ToListAsync(ct),
|
||||
VirtualTags = await db.VirtualTags.AsNoTracking().OrderBy(x => x.VirtualTagId).ToListAsync(ct),
|
||||
ScriptedAlarms = await db.ScriptedAlarms.AsNoTracking().OrderBy(x => x.ScriptedAlarmId).ToListAsync(ct),
|
||||
ApiKeys = snapshot.ApiKeys.OrderBy(x => x.ApiKeyId, StringComparer.Ordinal).ToList(),
|
||||
Scripts = snapshot.Scripts.OrderBy(x => x.ScriptId, StringComparer.Ordinal).ToList(),
|
||||
VirtualTags = snapshot.VirtualTags.OrderBy(x => x.VirtualTagId, StringComparer.Ordinal).ToList(),
|
||||
ScriptedAlarms = snapshot.ScriptedAlarms.OrderBy(x => x.ScriptedAlarmId, StringComparer.Ordinal).ToList(),
|
||||
};
|
||||
|
||||
return Pack(JsonSerializer.SerializeToUtf8Bytes(snapshot, JsonOptions));
|
||||
return Pack(JsonSerializer.SerializeToUtf8Bytes(ordered, JsonOptions));
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
|
||||
Reference in New Issue
Block a user