Equipment-scoped grants cannot authorize production-authored opaque scripted alarm IDs #797

New Issue

2026-11-10T12:50:18-05:00

dohertj2 commented

2026-11-10 12:50:18 -05:00

Found while executing #782. This is independently reproduced on original application baseline 83ed880e / SDK 1.5.378.182 and candidate SDK 2.0.1, and is not a new SDK regression.

A real activated session has zero application-wide roles, an enabled API key and an Equipment grant on EqA. A scripted condition whose valid opaque ID is scripted-eqa-hi is parented under EqA. Its current-trunk Acknowledge is denied BadUserAccessDenied; no command routes. Replacing only the grant with a Cluster grant permits the same method on the same condition and routes once. Both versions passed this explicit deny/positive regression probe.

The production UI enforces ScriptedAlarmId ^[A-Za-z0-9_-]+$; UnsTreeService stores it unchanged, and AddressSpaceApplier.MaterialiseAlarmCondition uses it as NodeId. EvaluateAlarmCommandGate passes that NodeId to DataPlaneAuthorizer.BuildScope, which splits the opaque identifier as a topology path. It cannot match the equipment's [uns, EqA] path. A slash-qualified synthetic fixture must not be used to claim this production case works.

Design a separate reviewed binding from the exact live scripted condition to its owning equipment scope. Preserve opaque NodeIds/AlarmCommand.AlarmId and deny unknown/deleted/replaced sources. Recheck current key, grant and authority generation; do not grant broad roles or use a permissive parent fallback. Cover initial and repeated Ack/Confirm, sibling equipment, revoked/expired key, delete/recreate, and exact event/routing counts with positive narrow grants and negatives.

For #782 the current application denial is preserved and retained as an independent baseline oracle. Native narrow-device retry authorization passes; scripted current-trunk compatibility uses an explicitly declared cluster grant and does not close this narrow-equipment feature gap. Reproduction helper is being committed under scripts/validation/opcua-scripted-alarm-baseline; candidate test Sdk2OpaqueScriptedScopeBaselineTests. No permission widening was implemented.

Found while executing #782. This is independently reproduced on original application baseline 83ed880e / SDK 1.5.378.182 and candidate SDK 2.0.1, and is not a new SDK regression. A real activated session has zero application-wide roles, an enabled API key and an Equipment grant on EqA. A scripted condition whose valid opaque ID is scripted-eqa-hi is parented under EqA. Its current-trunk Acknowledge is denied BadUserAccessDenied; no command routes. Replacing only the grant with a Cluster grant permits the same method on the same condition and routes once. Both versions passed this explicit deny/positive regression probe. The production UI enforces ScriptedAlarmId ^[A-Za-z0-9_-]+$; UnsTreeService stores it unchanged, and AddressSpaceApplier.MaterialiseAlarmCondition uses it as NodeId. EvaluateAlarmCommandGate passes that NodeId to DataPlaneAuthorizer.BuildScope, which splits the opaque identifier as a topology path. It cannot match the equipment's [uns, EqA] path. A slash-qualified synthetic fixture must not be used to claim this production case works. Design a separate reviewed binding from the exact live scripted condition to its owning equipment scope. Preserve opaque NodeIds/AlarmCommand.AlarmId and deny unknown/deleted/replaced sources. Recheck current key, grant and authority generation; do not grant broad roles or use a permissive parent fallback. Cover initial and repeated Ack/Confirm, sibling equipment, revoked/expired key, delete/recreate, and exact event/routing counts with positive narrow grants and negatives. For #782 the current application denial is preserved and retained as an independent baseline oracle. Native narrow-device retry authorization passes; scripted current-trunk compatibility uses an explicitly declared cluster grant and does not close this narrow-equipment feature gap. Reproduction helper is being committed under scripts/validation/opcua-scripted-alarm-baseline; candidate test Sdk2OpaqueScriptedScopeBaselineTests. No permission widening was implemented.

dohertj2 added the type:bug priority:p2 labels 2026-11-10 12:50:18 -05:00

dohertj2 referenced this issue

2026-11-10 13:11:08 -05:00

SDK2 live gate: AVEVA history, consumer compatibility and paired-cluster rollout #801

dohertj2 referenced this issue

2026-11-10 13:30:50 -05:00

WIP: Upgrade OPC UA SDK to 2.0.1 preserving application contracts #802

dohertj2 referenced this issue

2026-11-10 13:31:57 -05:00

Upgrade OPC Foundation SDK 1.5.378 → 2.0.x (public SecureChannelContext.PeerAddress replaces #751 reflection) #782

Sign in to join this conversation.