fix(alarms): surface a refused native alarm ack synchronously, revert one that fails later (lmxopcua#760)

The native-ack path is fire-and-forget after the Part 9 Acknowledge returns, so a Galaxy ack refused for lack of a credential (#749), or rejected by MXAccess, left the client with Good and the condition showing Acknowledged while Galaxy was never acked. Both options from the issue, layered: 1. Synchronous refusal for what the driver can decide without I/O. New optional IAlarmAcknowledgePreflight (Core.Abstractions); GalaxyDriver refuses an anonymous session when the driver has no AlarmAck fallback account. DriverHostActor publishes a condition NodeId -> owning-driver snapshot into NativeAlarmAckPreflightView (lock-free, volatile); the node manager's new NativeAlarmAckPreflight seam, consulted after the authz and Primary gates, returns BadUserAccessDenied with the reason - nothing routed, applied or reported. A keyed session is not pre-checked (its identity lives in the Secrets store, which must not be read under the SDK lock). 2. Revert for everything else. RouteAlarmAck carries the condition NodeId; DriverInstanceActor replies AlarmAckFailed on a refusal, a backend failure, a driver without an alarm source, or an ack dropped while connecting / reconnecting. DriverHostActor re-projects the condition unacknowledged via NativeAlarmProjector.TryRevertAcknowledge, but only while the local ack is still pending - any driver transition projected since then wins. A disabled or unspawned driver is not reverted (unchanged). GatewayGalaxyAlarmAcknowledger now throws DriverOperationRefusedException on a non-zero native hresult (wrong password, no ack permission) instead of only warning, so that case reverts too; as a refusal it neither retries nor trips the breaker. Tests (each fails with its fix mutated out): projector revert/supersede, DriverHostActor refused + failed ack -> unacked AlarmStateUpdate (successful ack control), preflight view snapshot, node-manager preflight unit test, over-the-wire ConditionMethodEventTests (BadUserAccessDenied, no route, no event; positive control), Galaxy preflight + hresult refusal. Docs: Galaxy.md, AlarmTracking.md, ScriptedAlarms.md, .claude/rules/alarms.md. Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV
2026-11-09 13:12:17 -05:00
parent 0217d36cf4
commit 8e8d4cdf13
21 changed files with 737 additions and 61 deletions
@@ -493,6 +493,63 @@ public sealed class ConditionMethodEventTests
        finally { await rig.DisposeAsync(); }
    }

+    /// <summary>
+    ///     lmxopcua#760 — an OPC UA Acknowledge of a NATIVE condition that the owning driver's synchronous pre-check
+    ///     refuses (e.g. an anonymous session on a Galaxy driver with no fallback ack account) fails ON THE WIRE with
+    ///     <c>BadUserAccessDenied</c> carrying the driver's reason: nothing is routed, applied or reported. Once the
+    ///     pre-check has no objection the same call is accepted (the positive control).
+    /// </summary>
+    [Fact]
+    public async Task A_native_acknowledge_the_driver_would_refuse_is_refused_synchronously()
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var rig = await StartAsync("CondNativeAckPreflight", encrypted: false, ct);
+        try
+        {
+            rig.Enforce(true, [Key()], ClusterGrant(KeyPrincipal, "acl-key", All));
+            rig.MaterialiseNative();
+            var current = PreState("Acknowledge", native: true) with { Message = "base" };
+            WireSimulatedOwners(rig, native: true, () => current, s => current = s);
+            var routed = 0;
+            var driverAck = rig.Nm.NativeAlarmAckRouter!;
+            rig.Nm.NativeAlarmAckRouter = ack => { Interlocked.Increment(ref routed); driverAck(ack); };
+            string? refusal = "no Galaxy ack account is configured for this session";
+            rig.Nm.NativeAlarmAckPreflight = _ => refusal;
+
+            using var session = await rig.ConnectAsync(anonymous: false, ct);
+            var events = new RecordedEvents();
+            var subscription = await RecordedEvents.SubscribeAsync(session, events, ct);
+            var item = RecordedEvents.AddEventItem(subscription, ObjectIds.Server);
+            await subscription.ApplyChangesAsync(ct);
+
+            rig.Project(native: true, current);
+            await RecordedEvents.WaitUntilAsync(() => events.Has(item, "base"));
+            var condition = ConditionNodeId(session, native: true);
+
+            var refused = await Should.ThrowAsync<ServiceResultException>(
+                CallAsync(session, condition, "Acknowledge", events.LatestEventId(item, "base"), ct));
+            refused.StatusCode.ShouldBe(StatusCodes.BadUserAccessDenied);
+            routed.ShouldBe(0, "a refused ack reaches no driver");
+            rig.Nm.TryGetAlarmCondition(RawAlarmPath, AddressSpaceRealm.Raw)!.AckedState.Id.Value
+                .ShouldBeFalse("a refused ack applies nothing");
+
+            // Positive control: with nothing to object to, the same call is accepted, routed and reported.
+            refusal = null;
+            await CallAsync(session, condition, "Acknowledge", events.LatestEventId(item, "base"), ct);
+            await rig.DrainProjectionsAsync();
+            routed.ShouldBe(1);
+
+            rig.Project(native: true, current = current with { Message = "sentinel" });
+            await RecordedEvents.WaitUntilAsync(() => events.Has(item, "sentinel"));
+            var baseEvents = events.ConditionEvents(item, "base");
+            baseEvents.Count.ShouldBe(2, "the base transition plus the accepted ack's event; the refusal reported nothing");
+            baseEvents[1][RecordedEvents.AckedField].Value.ShouldBe(true);
+
+            await subscription.DeleteAsync(true, ct);
+        }
+        finally { await rig.DisposeAsync(); }
+    }
+
    /// <summary>
    ///     Acknowledging an acknowledged condition WITHOUT a comment reports nothing, and does not flip a scripted
    ///     condition's Confirmed out of step with its engine. With a comment it reports exactly one event carrying