Native alarm ack: surface Galaxy ack-credential refusal as a synchronous OPC UA status #760

New Issue

2026-11-06T16:19:32-05:00

dohertj2 commented

2026-11-06 16:19:32 -05:00

Follow-up to #749.

#749 makes the Galaxy driver refuse a native alarm acknowledge when neither the session's API key has a Galaxy ack identity nor the driver has an AlarmAck fallback account (DriverOperationRefusedException; nothing is sent to mxaccessgw, never an empty operator_user). The refusal is excluded from the resilience breaker and logged by DriverInstanceActor with the fix.

Gap: the native-ack path is fire-and-forget after the Part 9 Acknowledge method returns (OtOpcUaNodeManager.HandleNativeAlarmAck -> NativeAlarmAckRouter -> DriverHostActor -> DriverInstanceActor), so the OPC UA call still returns Good and the local condition shows Acknowledged while Galaxy was never acked. The same is true of any async gateway rejection (wrong password -> non-zero hresult).

Options:

Synchronous pre-check in the node manager: a host-published, lock-free snapshot of (condition NodeId -> owning driver's ack-credential capability: has fallback?) plus the set of key ids with a Galaxy ack identity (from Secrets-store metadata), returning BadUserAccessDenied with a reason when neither applies. Racy against just-made changes, but covers the static misconfiguration case.
Revert-on-failure: DriverInstanceActor reports a refused/failed ack back to DriverHostActor, which un-marks the projector and re-reports the condition Unacknowledged (mirrors write-outcome self-correction). Covers async gateway failures too, but the client still sees Good on the call.

Recommendation: 2 (covers every failure class), optionally plus 1 for a clear status on the common misconfiguration.

Follow-up to #749. #749 makes the Galaxy driver refuse a native alarm acknowledge when neither the session's API key has a Galaxy ack identity nor the driver has an `AlarmAck` fallback account (`DriverOperationRefusedException`; nothing is sent to mxaccessgw, never an empty operator_user). The refusal is excluded from the resilience breaker and logged by `DriverInstanceActor` with the fix. Gap: the native-ack path is fire-and-forget after the Part 9 `Acknowledge` method returns (`OtOpcUaNodeManager.HandleNativeAlarmAck` -> `NativeAlarmAckRouter` -> `DriverHostActor` -> `DriverInstanceActor`), so the OPC UA call still returns `Good` and the local condition shows Acknowledged while Galaxy was never acked. The same is true of any async gateway rejection (wrong password -> non-zero hresult). Options: 1. Synchronous pre-check in the node manager: a host-published, lock-free snapshot of (condition NodeId -> owning driver's ack-credential capability: has fallback?) plus the set of key ids with a Galaxy ack identity (from Secrets-store metadata), returning `BadUserAccessDenied` with a reason when neither applies. Racy against just-made changes, but covers the static misconfiguration case. 2. Revert-on-failure: `DriverInstanceActor` reports a refused/failed ack back to `DriverHostActor`, which un-marks the projector and re-reports the condition Unacknowledged (mirrors write-outcome self-correction). Covers async gateway failures too, but the client still sees `Good` on the call. Recommendation: 2 (covers every failure class), optionally plus 1 for a clear status on the common misconfiguration.

dohertj2 added the priority:p2 label 2026-11-06 16:19:32 -05:00

dohertj2 referenced this issue from a commit

2026-11-06 16:23:06 -05:00

feat(galaxy): operator-authenticated alarm ack — send Galaxy credential to mxaccessgw (#749)

dohertj2 referenced this issue

2026-11-06 16:26:06 -05:00

Galaxy: send operator credential in AcknowledgeAlarmRequest (mxaccessgw AckMsg-as-operator) #749

Sign in to join this conversation.