Merge lane C: control plane, host, security (#733)

Claude-Session: https://claude.ai/code/session_01Ub9hGmYLQvn9XETzw7CMsT
2026-10-22 14:09:08 -04:00
parent 3e0606af58 5097444d56
commit 7bcb6331ed
61 changed files with 6603 additions and 453 deletions
@@ -0,0 +1,117 @@
+using Microsoft.Data.SqlClient;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Diagnostics;
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Configuration.Entities;
+using ZB.MOM.WW.OtOpcUa.Configuration.Enums;
+using ZB.MOM.WW.OtOpcUa.Configuration.Validation;
+
+namespace ZB.MOM.WW.OtOpcUa.Configuration.Tests;
+
+/// <summary>
+///     R03:3.2 on the real provider: the migrated config database allows SNAPSHOT isolation (migration
+///     <c>EnableSnapshotIsolation</c>) and <see cref="DraftSnapshotFactory.FromConfigDbAsync"/> reads under
+///     it. The InMemory tests cannot see either — the provider has no transactions — so this is the one
+///     place the deploy path's "one consistent read" is proven against SQL Server.
+/// </summary>
+[Trait("Category", "SchemaCompliance")]
+[Collection(nameof(SchemaComplianceCollection))]
+public sealed class DraftSnapshotFactorySqlServerTests
+{
+    private readonly SchemaComplianceFixture _fixture;
+
+    /// <summary>Initializes a new instance of the <see cref="DraftSnapshotFactorySqlServerTests"/> class.</summary>
+    /// <param name="fixture">The migrated test database.</param>
+    public DraftSnapshotFactorySqlServerTests(SchemaComplianceFixture fixture) => _fixture = fixture;
+
+    /// <summary>The migration leaves the database with snapshot isolation allowed.</summary>
+    [Fact]
+    public void Migrated_database_allows_snapshot_isolation()
+    {
+        using var conn = _fixture.OpenConnection();
+        using var cmd = new SqlCommand(
+            "SELECT snapshot_isolation_state_desc FROM sys.databases WHERE name = DB_NAME();", conn);
+        cmd.ExecuteScalar().ShouldBe("ON");
+    }
+
+    /// <summary>
+    ///     A row committed by another connection while the snapshot read is in progress is NOT observed by
+    ///     the tables read after it — every table reflects the instant the transaction started. Positive
+    ///     control: a read started after the commit does see the row.
+    /// </summary>
+    [Fact]
+    public async Task FromConfigDb_reads_every_table_as_of_one_instant()
+    {
+        var clusterId = $"SNAP-{Guid.NewGuid():N}"[..24];
+        var scriptId = $"late-{Guid.NewGuid():N}";
+        await using (var seed = NewContext())
+        {
+            seed.ServerClusters.Add(new ServerCluster
+            {
+                ClusterId = clusterId, Name = "snapshot-read", Enterprise = "zb", Site = "test",
+                NodeCount = 1, RedundancyMode = RedundancyMode.None, CreatedBy = "test",
+            });
+            await seed.SaveChangesAsync();
+        }
+
+        try
+        {
+            var options = new DbContextOptionsBuilder<OtOpcUaConfigDbContext>()
+                .UseSqlServer(_fixture.ConnectionString)
+                .AddInterceptors(new LateEditInterceptor(_fixture.ConnectionString, clusterId, scriptId))
+                .Options;
+
+            await using (var db = new OtOpcUaConfigDbContext(options))
+            {
+                var snapshot = await DraftSnapshotFactory.FromConfigDbAsync(db);
+                // The interceptor committed a Script while ServerClusters (the FIRST table read) was being
+                // materialised. Scripts is read later in the same transaction and must not see it.
+                snapshot.ServerClusters.ShouldContain(c => c.ClusterId == clusterId);
+                snapshot.Scripts.ShouldNotContain(s => s.ScriptId == scriptId);
+            }
+
+            await using (var verify = NewContext())
+            {
+                // Positive control: the edit really landed, and a read started afterwards sees it.
+                (await verify.Scripts.AnyAsync(s => s.ScriptId == scriptId)).ShouldBeTrue();
+                var later = await DraftSnapshotFactory.FromConfigDbAsync(verify);
+                later.Scripts.ShouldContain(s => s.ScriptId == scriptId);
+            }
+        }
+        finally
+        {
+            await using var cleanup = NewContext();
+            await cleanup.Scripts.Where(s => s.ScriptId == scriptId).ExecuteDeleteAsync();
+            await cleanup.ServerClusters.Where(c => c.ClusterId == clusterId).ExecuteDeleteAsync();
+        }
+    }
+
+    private OtOpcUaConfigDbContext NewContext() => new(
+        new DbContextOptionsBuilder<OtOpcUaConfigDbContext>().UseSqlServer(_fixture.ConnectionString).Options);
+
+    /// <summary>
+    ///     Commits a Script on a SEPARATE connection the first time the snapshot read materialises the
+    ///     seeded ServerCluster row — i.e. mid-read, after the first table and before Scripts.
+    /// </summary>
+    private sealed class LateEditInterceptor(string connectionString, string clusterId, string scriptId)
+        : IMaterializationInterceptor
+    {
+        private int _fired;
+
+        public object InitializedInstance(MaterializationInterceptionData materializationData, object entity)
+        {
+            if (entity is ServerCluster c && c.ClusterId == clusterId && Interlocked.Exchange(ref _fired, 1) == 0)
+            {
+                using var other = new OtOpcUaConfigDbContext(
+                    new DbContextOptionsBuilder<OtOpcUaConfigDbContext>().UseSqlServer(connectionString).Options);
+                other.Scripts.Add(new Script
+                {
+                    ScriptId = scriptId, Name = "late edit", SourceCode = "return 1;", SourceHash = "late-hash",
+                });
+                other.SaveChanges();
+            }
+            return entity;
+        }
+    }
+}
@@ -103,6 +103,36 @@ public sealed class DraftSnapshotFactoryTests : IDisposable
        snapshot.ActiveReservations[0].ReleasedAt.ShouldBeNull();
    }

+    /// <summary>
+    ///     R03:3.2 — the deploy path validates AND composes from ONE snapshot, so the tables the composer
+    ///     needs beyond the validator's set (clusters, nodes, API keys) must ride the same read.
+    /// </summary>
+    [Fact]
+    public async Task FromConfigDb_carries_clusters_nodes_and_api_keys_for_the_composer()
+    {
+        _db.ServerClusters.Add(new ServerCluster
+        {
+            ClusterId = "SITE-A", Name = "Site A", Enterprise = "zb", Site = "site-a",
+            NodeCount = 1, RedundancyMode = RedundancyMode.None, CreatedBy = "test",
+        });
+        _db.ClusterNodes.Add(new ClusterNode
+        {
+            NodeId = "site-a-1:4053", ClusterId = "SITE-A", Host = "site-a-1",
+            ApplicationUri = "urn:OtOpcUa:site-a-1", Enabled = true, CreatedBy = "test",
+        });
+        _db.ApiKeys.Add(new ApiKey
+        {
+            ApiKeyId = "k1", Name = "scada", SecretHash = "hash", Principal = "scadabridge", Enabled = true,
+        });
+        await _db.SaveChangesAsync();
+
+        var snapshot = await DraftSnapshotFactory.FromConfigDbAsync(_db);
+
+        snapshot.ServerClusters.ShouldHaveSingleItem().ClusterId.ShouldBe("SITE-A");
+        snapshot.ClusterNodes.ShouldHaveSingleItem().NodeId.ShouldBe("site-a-1:4053");
+        snapshot.ApiKeys.ShouldHaveSingleItem().ApiKeyId.ShouldBe("k1");
+    }
+
    private void SeedEquipment(string equipmentId)
    {
        var uuid = Guid.NewGuid();