test: record actual ScadaBridge consumer and baseline authorization gates

2026-11-10 13:17:13 -05:00
parent 8d75ac8c6c
commit ff44167926
13 changed files with 555 additions and 0 deletions
@@ -0,0 +1,35 @@
+# Independent scripted-alarm scope baseline
+
+This SDK 1.5.378.182-only source probe records the existing opaque-ID behavior
+tracked by [#797](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/797).
+It is deliberately outside the candidate solution and is not a runtime adapter.
+
+Use a clean, separate checkout at original application commit
+`83ed880e4471344deaf008da9bd028c7e170bdc7`. Confirm its package pins before
+running. Copy **only** `ScriptedScopeProbe.cs` temporarily into that checkout's
+`tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests/`, refusing to
+overwrite an existing file. Run:
+
+```sh
+dotnet test tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests \
+  -c Release --filter FullyQualifiedName~BaselineScriptedScopeProbe \
+  --logger trx --results-directory /absolute/fresh-baseline-evidence
+```
+
+Preserve the test exit and run the baseline checkout's
+`scripts/ci/assert-not-all-skipped.sh` with `MIN_EXECUTED=1` against the fresh TRX.
+Remove only the temporary probe you copied after the run, keeping the source
+and TRX evidence here/outside the checkout. Verify baseline tracked files remain
+unchanged. Never load this assembly or old SDK into the candidate process.
+
+The real session has no application-wide roles. The production-valid opaque
+scripted ID is denied by an Equipment grant, routes nothing, and is then allowed
+by an explicit Cluster grant. A passing probe pins **both** outcomes; it does not
+claim narrow equipment authorization works. The independent candidate counterpart
+is `Sdk2OpaqueScriptedScopeBaselineTests`.
+
+Do not make the ID slash-qualified to get a positive result: the current UI
+rejects `/`, and that would hide the production scope-resolution defect. A future
+fix requires reviewed ownership/scope binding without changing opaque IDs or
+widening permissions. This upgrade preserves the baseline denial and links the
+separate defect.