feat(adminui): manual failover control on the cluster redundancy page

Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW
2026-07-22 06:44:44 -04:00
parent 69b697bc3e
commit d8a85c3d89
4 changed files with 442 additions and 2 deletions
@@ -0,0 +1,134 @@
+using ZB.MOM.WW.OtOpcUa.ControlPlane.Redundancy;
+using ZB.MOM.WW.OtOpcUa.Security.Auth;
+
+namespace ZB.MOM.WW.OtOpcUa.AdminUI.Redundancy;
+
+/// <summary>
+/// Presentation state for the Trigger-failover control on the cluster redundancy page.
+/// </summary>
+/// <remarks>
+///     <para>
+///         A pure model behind a thin razor shell — the same split the driver-typed tag editors use,
+///         and for the same reason: this repo has no bUnit (see
+///         <c>PageAuthorizationGuardTests</c>), so anything left inside the <c>.razor</c> is verified
+///         only by driving the page live. The peer guard, the confirm flow, and the
+///         refused-vs-succeeded outcome are consequential enough to be unit-testable, so they live
+///         here.
+///     </para>
+///     <para>
+///         What is deliberately NOT here: the markup authorization gate. It is expressed in the razor
+///         as <c>&lt;AuthorizeView Policy="@ManualFailoverPageModel.RequiredPolicy"&gt;</c> and
+///         re-checked server-side before the call, so <see cref="RequiredPolicy"/> is the single
+///         source of truth for both.
+///     </para>
+/// </remarks>
+public sealed class ManualFailoverPageModel
+{
+    /// <summary>
+    /// The policy gating the control, in markup and in the server-side re-check.
+    /// </summary>
+    /// <remarks>
+    /// <see cref="AdminUiPolicies.FleetAdmin"/> (Administrator only) rather than the
+    /// <see cref="AdminUiPolicies.ConfigEditor"/> the neighbouring cluster-authoring pages use:
+    /// this does not edit configuration, it restarts a production node. ConfigEditor also admits the
+    /// Designer role, which must not be able to bounce the Primary.
+    /// </remarks>
+    public const string RequiredPolicy = AdminUiPolicies.FleetAdmin;
+
+    private readonly IManualFailoverService _service;
+
+    /// <summary>Creates the model over the failover service.</summary>
+    /// <param name="service">The manual-failover seam; faked in tests.</param>
+    public ManualFailoverPageModel(IManualFailoverService service)
+        => _service = service ?? throw new ArgumentNullException(nameof(service));
+
+    /// <summary>The last read cluster snapshot, or <see langword="null"/> if it could not be read.</summary>
+    public ManualFailoverSnapshot? Snapshot { get; private set; }
+
+    /// <summary>Whether the confirmation dialog is open.</summary>
+    public bool ConfirmOpen { get; private set; }
+
+    /// <summary>Status text from the last completed action, if any.</summary>
+    public string? StatusMessage { get; private set; }
+
+    /// <summary>Whether <see cref="StatusMessage"/> reports a failure.</summary>
+    public bool StatusIsError { get; private set; }
+
+    /// <summary>Whether the button is enabled — a peer must exist to take over.</summary>
+    public bool CanFailOver => Snapshot?.CanFailOver == true;
+
+    /// <summary>
+    /// Why the button is disabled, or <see langword="null"/> when it is enabled. Rendered as the
+    /// button's tooltip so a disabled control explains itself.
+    /// </summary>
+    public string? DisabledReason => Snapshot is null
+        ? "Cluster state is unavailable on this node."
+        : Snapshot.CanFailOver
+            ? null
+            : $"Failover needs a driver peer to take over; this mesh has {Snapshot.DriverAddresses.Count} Up driver member(s).";
+
+    /// <summary>Re-reads live cluster state. Never throws — an unreadable cluster disables the button.</summary>
+    public void Refresh()
+    {
+        try
+        {
+            Snapshot = _service.GetSnapshot();
+        }
+        catch (Exception ex)
+        {
+            // A node whose ActorSystem is not yet up (or not a cluster provider) must render the page,
+            // not 500. The button stays disabled with DisabledReason explaining why.
+            Snapshot = null;
+            StatusIsError = true;
+            StatusMessage = $"Could not read cluster state: {ex.Message}";
+        }
+    }
+
+    /// <summary>Opens the confirmation dialog. No-op when the peer guard is closed.</summary>
+    public void RequestFailover()
+    {
+        if (!CanFailOver) return;
+        StatusMessage = null;
+        StatusIsError = false;
+        ConfirmOpen = true;
+    }
+
+    /// <summary>Closes the confirmation dialog without acting.</summary>
+    public void CancelFailover() => ConfirmOpen = false;
+
+    /// <summary>
+    /// Performs the failover the dialog is confirming.
+    /// </summary>
+    /// <param name="actor">The authenticated user name, recorded in the audit event.</param>
+    public async Task ConfirmFailoverAsync(string actor)
+    {
+        if (!ConfirmOpen) return;
+        ConfirmOpen = false;
+
+        try
+        {
+            var target = await _service.FailOverDriverPrimaryAsync(actor).ConfigureAwait(false);
+            if (target is null)
+            {
+                // The service re-evaluates the peer guard against live state, which may have changed
+                // since Refresh(). A refusal is not an error — but it must not read as a success.
+                StatusIsError = true;
+                StatusMessage = "Failover refused: no driver peer is available to take over.";
+            }
+            else
+            {
+                StatusIsError = false;
+                StatusMessage =
+                    $"Failover requested. {target} is leaving the cluster; its peer takes over as Primary "
+                    + "and the node restarts as the youngest member.";
+            }
+        }
+        catch (Exception ex)
+        {
+            StatusIsError = true;
+            StatusMessage = $"Failover failed: {ex.Message}";
+        }
+
+        Refresh();
+    }
+}