9 Commits

Author	SHA1	Message	Date
Joseph Doherty	f88eb49bd1	feat(acl): ApiKey entity + key format, and put Core on the server's graph (#520) ... Stage 1b. Still no enforcement wired — this adds the credential model the identity cutover (stage 2) will read. ApiKey holds one principal per key, deliberately. The reason to separate keys from principals is so many keys share a grant set and rotating a key never touches an ACL row, and that holds with one principal per key since nothing stops two keys naming the same principal. A key belonging to several principals at once buys little and costs a join table. UserAuthorizationState.Principals stays a list, so adding it later needs no ACL-side change. ApiKeySecret is the security-critical half and is pure, so it is tested on its own: otua_<keyId>_<secret>, peppered HMAC-SHA256, FixedTimeEquals. Notes why a plain HMAC rather than an iterated KDF (the secret is 32 bytes of CSPRNG, and the call runs inline on session activation, which the SDK serializes server-wide behind its SessionManager event lock), and fails closed on an unset pepper rather than hashing under an empty key. Found and fixed a bug in my own first draft: the key id was url-safe base64, whose alphabet maps '/' to '_' — the very character TryParse splits on. Roughly one key in five would have had its id truncated at a random position, an intermittent auth failure reproducing only for SOME keys. The id is hex now, and the guard is falsified: reverting the alphabet reds both The_generated_key_id_never_contains_the_separator and, as a bonus signal, Two_generated_keys_never_collide, because truncated ids collide. ApiKeyId is NOT NULL, unlike the nullable NodeAclId precedent whose filtered unique index would admit two NULL ids. Fine for a config row, not for a credentials lookup key. OpcUaServer.csproj now references Core. Until now it did not, so IPermissionEvaluator was literally uncallable from the node manager — the place enforcement has to happen. No new transitive package surface. Schema doc updated for both, and its NodeAcl block flagged for pre-existing drift (it still documents the GenerationId column v3 dropped) without fixing it here. Core 247, OpcUaServer 364, Configuration 128 — all green. Claude-Session: https://claude.ai/code/session_015p7wGqy3YpZNCpDzTpGMKo	2026-07-31 12:27:28 -04:00
Joseph Doherty	d979ac69eb	refactor(config): drop the dead DriverInstanceResilienceStatus table (#524) ... The sibling of #521's DriverHostStatus, dead for exactly the same reason. Before this change the only reference in the entire repo was the DriverInstanceResilienceStatuses DbSet declaration: no writer, no reader, and the table empty on every deployment. Its entity doc described two components that were never built — a HostedService sampling the tracker every ~5 s into this table, and an AdminUI that left-joined it on DriverHostStatus for display. There is no sampler, that join exists in no razor file, and DriverHostStatus itself was removed in #521. Per-cluster mesh Phase 4 also makes the design unbuildable now: AddOtOpcUaConfigDb is gated on the admin role, so a driver-only node has no ConfigDb connection to write rows with. Any per-node runtime-status table has this problem. The live data was never missing — it just does not go through SQL. Resilience counters reach the AdminUI's DriverStatusPanel as DriverResilienceStatusChanged over the driver-resilience-status telemetry channel into the in-memory IDriverResilienceStatusStore. Verified consumed: the panel injects the store, fed by both DriverResilienceStatusBridge (DPS) and TelemetryDialSupervisor (gRPC). If breaker HISTORY across a central restart is ever wanted — the one thing the last-value-only store cannot give — it needs a CENTRAL-side writer fed by that stream, never a driver-node writer. Keeping an empty table now bought nothing toward that. Migration DropDriverInstanceResilienceStatusTable; the scaffolder's data-loss warning cannot bite on a table nothing ever inserted into, and Down() recreates it exactly. Also corrected: DriverResilienceStatusTracker's doc-comment claimed CurrentInFlight fed DriverInstanceResilienceStatus.CurrentBulkheadDepth "until the full telemetry observer lands". The observer landed in Phase 5; the table never had a writer. Claude-Session: https://claude.ai/code/session_015p7wGqy3YpZNCpDzTpGMKo	2026-07-31 03:37:10 -04:00
Joseph Doherty	cbb882293b	refactor(drivers): delete the inert driver-tier recycle machinery (#522) ... The tier system was documented, operator-authorable, and inert. Deleted rather than activated, because its premise is gone rather than merely unused. "Tier C" meant a driver running out-of-process behind an IDriverSupervisor that could restart its Host without tearing down the OPC UA session. No such process exists anywhere: Galaxy reaches MXAccess over gRPC to the external mxaccessgw sidecar (PR 7.2 retired the in-process Galaxy.Host/Proxy/Shared projects) and FOCAS has run in-process since its managed wire client landed 2026-04-24. Consistently, IDriverSupervisor had ZERO implementations and there was nothing for one to implement against. The issue understated the inertness. It says the Tier-C-only protections never engaged, implying the Tier A/B parts did. They did not: nothing constructs MemoryTracking, MemoryRecycle or ScheduledRecycleScheduler outside their own unit tests, so the whole Core/Stability recycle layer was dead — meaning option (a), "pass real tiers", was never a flag flip. It would have meant writing the wiring that never existed AND arming it. Deleted: MemoryTracking, MemoryRecycle, ScheduledRecycleScheduler, IDriverSupervisor, the vestigial DriverTypeRegistry (referenced only by its own tests), and the RecycleIntervalSeconds knob — which the AdminUI let an operator author and the parser validated while it configured nothing. DriverTier itself SURVIVES and is load-bearing: DriverResilienceOptions.GetTierDefaults supplies the real per-capability timeout/retry/breaker policies via DriverFactoryRegistry.GetTier and DriverCapabilityInvokerFactory. Only the isolation-and-recycle layer above it is gone. Deliberately NOT deleted: - WedgeDetector came along in the same directory and is equally dead in production, but it is tier-agnostic and is not recycle machinery — it only shares the folder. Restored rather than swept up in a decision that was not about it. - IDriver.GetMemoryFootprint() and FlushOptionalCachesAsync() lose their only consumer here. Removing them touches all 12 drivers and every test stub, so they are documented as consumerless and filed as #525 instead of buried in this diff. Compatibility: a deployed ResilienceConfig blob still carrying "recycleIntervalSeconds" parses cleanly (unknown keys are ignored — guarded by a new test, because a blob that suddenly failed to parse would fall back to tier defaults and silently discard the operator's real overrides), and the AdminUI's preserve-unknown-keys bag keeps the key rather than rewriting stored config on an unrelated edit. The 01/U-6 knob-inertness guard carried an explicit carve-out admitting RecycleIntervalSeconds was dormant and out of scope; that carve-out is now gone, so the expected set is literally what the test's name claims. Note: Host.IntegrationTests has 2 failures (DriverProbeRegistrationTests.is_idempotent, PrimaryGateFailoverTests) — verified pre-existing by reproducing both on clean master dc9d947b. Claude-Session: https://claude.ai/code/session_015p7wGqy3YpZNCpDzTpGMKo	2026-07-30 04:44:04 -04:00
Joseph Doherty	3a590a0cb7	refactor(mesh-phase4): retire EfAlarmConditionStateStore + drop dead ScriptedAlarmState table (Task 9) ... Scripted-alarm condition state lives in LocalDb (Phase 4); the ConfigDb-backed Ef store + ScriptedAlarmState table are now dead. Removes the test-harness Ef fallback (a DB-backed node with no store now skips the alarm host), deletes the store + entity + model config, and drops the table via migration. Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW	2026-07-23 14:33:11 -04:00
Joseph Doherty	4d39b98564	v3 batch1 WP1: greenfield DbContext + V3Initial squash + seeds + tests ... DbContext (OtOpcUaConfigDbContext): - Drop Namespace/EquipmentImportBatch/EquipmentImportRow DbSets + Configure methods. - Add RawFolder/TagGroup/UnsTagReference DbSets + Configure methods with sibling-name filtered unique indexes over nullable parents (two-filtered pattern per level). - Reshape DriverInstance (RawFolderId + UX_DriverInstance_Folder_Name/_ClusterRoot_Name), Tag (required DeviceId, nullable TagGroupId, UX_Tag_Group_Name/_Device_Name, IX_Tag_Device), Equipment (drop DriverInstanceId/DeviceId + IX_Equipment_Driver), Device (UX_Device_Driver_Name). Migration squash -> V3Initial: - Delete the whole Migrations/ folder; scaffold one V3Initial (applies clean to a fresh DB). - Port the hand-written procs + AuthorizationGrants into V3Initial.StoredProcedures.cs. The v1 generation-model procs (ConfigGeneration/GenerationId, dead since V2HostingAlignment) are rewritten as v3-schema-valid retirement stubs that preserve the two-role EXECUTE-grant surface + AuthorizationTests behaviors; sp_ComputeGenerationDiff now references the v3 tables; sp_ReleaseExternalIdReservation ported verbatim. Compile-fixes for the build gate (Wave-C-owned, minimal + TODO(v3 WP4) markers): - DraftSnapshot/DraftSnapshotFactory: drop the retired Namespaces list. - DraftValidator: delete namespace-binding + Galaxy-FullName rules; collision rule now VirtualTag-only. Seeds -> v3 schema: - seed-clusters.sql summary SELECTs; all 5 scripts/smoke/seed-*.sql rewritten (DriverInstance RawFolderId, Device+DeviceConfig endpoint, Tag DeviceId, UnsTagReference; no ConfigGeneration/ Namespace/sp_PublishGeneration). Verified: all seeds apply clean against a fresh V3Initial DB. Tests (Configuration.Tests, 107 pass): - SchemaComplianceTests rewritten to v3 tables + filtered indexes. - New RawSchemaIntegrityTests: DB-enforced sibling-name uniqueness per raw level + UnsTagReference (Equipment,Tag) uniqueness. - Delete DraftValidatorGalaxyFullNameCorpusTests (WP2/WP6 replaces); fix DraftValidatorTests + DraftSnapshotFactoryTests to v3 shapes; repoint scripting-migration existence test to V3Initial.	2026-07-15 19:19:21 -04:00
Joseph Doherty	64e3fbe035	docs: backfill XML documentation across 756 files ... Adds <summary>, <param>, <typeparam>, and <inheritdoc/> tags to public members surfaced by commentchecker — resolves 5,847 of 5,869 issues (99.6%) across three /fixdocs passes.	2026-05-28 08:10:17 -04:00
Joseph Doherty	76310b8829	chore(cleanup): delete OtOpcUa.Server, OtOpcUa.Admin, and obsolete v1 tests ... Task 56: removes the legacy in-process Server + Admin Web project + their test projects (Server.Tests, Admin.Tests, Admin.E2ETests). The fused OtOpcUa.Host binary built across Phases 1-9 is now the sole production entry point. What happened to the 47 legacy Admin Blazor pages: per follow-up F15, the v1 architecture's draft/publish UX is replaced by v2's live-edit + snapshot- deploy model, so a 1:1 migration is not meaningful. The mechanical move via git mv preserves the history; service classes + page bodies that referenced removed v1 types (ConfigGeneration, RedundancyRole, GenerationId) were deleted. AdminUI now ships a minimal Home page + the v2 Deployments page. Per-page rebuild against the v2 surface is tracked as F15. The v2 Deployments page (Task 52) is the only first-party UI shipping in this PR. Task 57: solution build green; 84+ tests green across active v2 + legacy driver test projects.	2026-05-26 05:38:31 -04:00
Joseph Doherty	605dbf3dcc	feat(configdb): V2HostingAlignment migration consolidating Phase 1a-1e ... Phase 1f — the consolidator migration. Closes out the v2 entity-model rewrite by emitting a single EF migration that captures the cumulative schema delta from 14a (RowVersion) through 14e (drop generation entities). Generated: src/Core/ZB.MOM.WW.OtOpcUa.Configuration/Migrations/ 20260526081556_V2HostingAlignment.cs (1562 lines) 20260526081556_V2HostingAlignment.Designer.cs Migration shape (per `grep -nE migrationBuilder.\(...)`): Drop 12 ForeignKey constraints (one per live-edit entity's GenerationId FK) Drop 2 Tables (ConfigGeneration, ClusterNodeGenerationState) Drop 45 Indexes (every UX_*_Generation_* and IX_*_Generation_* across the 13 live-edit tables — 1 also dropped the unique-Primary filtered index UX_ClusterNode_Primary_Per_Cluster) Drop 13 Columns (12 GenerationId + 1 RedundancyRole) Add 12 RowVersion columns (one per live-edit entity) Create 4 Tables (Deployment, NodeDeploymentState, ConfigEdit, DataProtectionKeys) Create ~45 Indexes (recreated under the new naming pattern UX_<Table>_LogicalId / UX_<Table>_<X> with the GenerationId column stripped from composite keys) Notable EF quirks accepted: Unique-on-required-column indexes (UX_VirtualTag_LogicalId etc.) ship a `filter: "[VirtualTagId] IS NOT NULL"` clause that EF auto-inserts for SQL Server. Harmless — the column is C#-side `required` so NULL never appears. Verification: dotnet build src/Core/ZB.MOM.WW.OtOpcUa.Configuration -> 0 errors dotnet ef migrations script --idempotent (against placeholder DSN) -> 3259-line .sql produced OK tests/Core/ZB.MOM.WW.OtOpcUa.Configuration.Tests -> 0 errors Live `dotnet ef database update` against a scratch SQL Server deferred to Task 15 (Migrate-To-V2.ps1) — SSH to the docker host needs a key/password I don't have, and the always-on SQL at 10.100.0.35,14330 uses Integrated Security (Windows auth, unreachable from this macOS dev). The migration itself is structurally correct by construction (EF tooling generated it against the live DbContext model); the live-DB confidence step is the PowerShell wrapper's job. SchemaComplianceTests updates: - All_expected_tables_exist: removed ConfigGeneration + ClusterNodeGenerationState; added Deployment, NodeDeploymentState, ConfigEdit, DataProtectionKeys. - Filtered_unique_indexes_match_schema_spec: removed entries for UX_ClusterNode_Primary_Per_Cluster (Task 14d) and UX_ConfigGeneration_Draft_Per_Cluster (Task 14e). Two filtered uniques remain (UX_ClusterNodeCredential_Value, UX_ExternalIdReservation_KindValue_Active). - Check_constraints_match_schema_spec: added CK_ConfigEdit_FieldsJson_IsJson. StoredProceduresTests update: - Removed RedundancyRole + 'Primary' from the raw INSERT into ClusterNode so the DB-backed test runs against the new schema.	2026-05-26 04:18:50 -04:00
Joseph Doherty	a25593a9c6	chore: organize solution into module folders (Core/Server/Drivers/Client/Tooling) ... Group all 69 projects into category subfolders under src/ and tests/ so the Rider Solution Explorer mirrors the module structure. Folders: Core, Server, Drivers (with a nested Driver CLIs subfolder), Client, Tooling. - Move every project folder on disk with git mv (history preserved as renames). - Recompute relative paths in 57 .csproj files: cross-category ProjectReferences, the lib/ HintPath+None refs in Driver.Historian.Wonderware, and the external mxaccessgw refs in Driver.Galaxy and its test project. - Rebuild ZB.MOM.WW.OtOpcUa.slnx with nested solution folders. - Re-prefix project paths in functional scripts (e2e, compliance, smoke SQL, integration, install). Build green (0 errors); unit tests pass. Docs left for a separate pass. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-17 01:55:28 -04:00