dohertj2/lmxopcua
1
0
Fork 0
Code Issues 5 Pull Requests Actions Packages Projects Releases Wiki Activity

Credential references: remove the warn-only compatibility path for running Galaxy/OpcUaClient drivers (hard-fail) #834

New Issue
Closed
opened 2026-11-11 03:27:26 -05:00 by dohertj2 · 5 comments
dohertj2 commented 2026-11-11 03:27:26 -05:00
Owner
Copy Link
Copy Source

Follow-up to #815 (owner chose warn-only for the first release). Running Galaxy/OpcUaClient drivers whose stored config has an out-of-namespace credential reference still resolve it with the old semantics via LegacyCredentialReferenceTracker (constructed only in GalaxyDriver.cs and OpcUaClientDriver.cs), emitting a rate-limited WARN and a credential-compat:<field> diagnostics entry. Save, deploy (CredentialReferenceOutOfScope), Test Connect and browse already hard-fail.

Once the CredentialReferencePreflightService warning / /raw banner has been clean on every deployment (prod included), delete the tracker and make resolve-time refusal unconditional. Migration table: docs/security.md (incl. env:MX_API_KEY, the old Galaxy form default, and file:).

Follow-up to #815 (owner chose warn-only for the first release). Running Galaxy/OpcUaClient drivers whose stored config has an out-of-namespace credential reference still resolve it with the old semantics via `LegacyCredentialReferenceTracker` (constructed only in GalaxyDriver.cs and OpcUaClientDriver.cs), emitting a rate-limited WARN and a `credential-compat:<field>` diagnostics entry. Save, deploy (`CredentialReferenceOutOfScope`), Test Connect and browse already hard-fail. Once the `CredentialReferencePreflightService` warning / `/raw` banner has been clean on every deployment (prod included), delete the tracker and make resolve-time refusal unconditional. Migration table: docs/security.md (incl. `env:MX_API_KEY`, the old Galaxy form default, and `file:`).
dohertj2 added the cross-drivertype:followuppriority:p2 labels 2026-11-11 03:27:26 -05:00
dohertj2 added the blocked label 2026-11-11 03:30:15 -05:00
dohertj2 commented 2026-11-11 03:30:16 -05:00
Author
Owner
Copy Link
Copy Source

Blocked: removal waits until the #815 preflight banner is clean on every deployment, prod included. Prod deploys are on hold (no remote exec on the wonder boxes), so this cannot be verified yet.

Blocked: removal waits until the #815 preflight banner is clean on every deployment, prod included. Prod deploys are on hold (no remote exec on the wonder boxes), so this cannot be verified yet.
dohertj2 commented 2026-11-11 11:47:53 -05:00
Author
Owner
Copy Link
Copy Source

Owner decision 2026-11-11: wait for the prod preflight. Warn-only stays until the owner confirms the /raw credential banner is clean on DEV/QA/prod. Stays blocked.

Owner decision 2026-11-11: **wait for the prod preflight.** Warn-only stays until the owner confirms the `/raw` credential banner is clean on DEV/QA/prod. Stays blocked.
dohertj2 commented 2026-11-13 01:54:50 -05:00
Author
Owner
Copy Link
Copy Source

Owner decision 2026-11-13: drop the "prod included" condition (no production box exists; any future prod install gets the strict behaviour from its first deploy). Read-only ConfigDb check, 2026-11-13:

  • DEV wonder-app-vd03 / OtOpcUaConfig: DriverInstance = FOCAS ×1
  • QA wonder-sql-vq03 / OtOpcUaConfig: DriverInstance = Calculation ×1 (script-runner canary)

No Galaxy or OpcUaClient driver on either tier, so LegacyCredentialReferenceTracker is never built and the compatibility path is unused. Unblocked; removal queued.

Owner decision 2026-11-13: drop the "prod included" condition (no production box exists; any future prod install gets the strict behaviour from its first deploy). Read-only ConfigDb check, 2026-11-13: - DEV `wonder-app-vd03` / `OtOpcUaConfig`: `DriverInstance` = FOCAS ×1 - QA `wonder-sql-vq03` / `OtOpcUaConfig`: `DriverInstance` = Calculation ×1 (script-runner canary) No Galaxy or OpcUaClient driver on either tier, so `LegacyCredentialReferenceTracker` is never built and the compatibility path is unused. Unblocked; removal queued.
dohertj2 removed the blocked label 2026-11-13 01:54:50 -05:00
dohertj2 commented 2026-11-13 02:07:48 -05:00
Author
Owner
Copy Link
Copy Source

Done in f0c6cf96 (master).

What changed

  • LegacyCredentialReferenceTracker deleted, with its rate-limited WARN and the credential-compat:<field> diagnostics entry. Also gone: the per-driver Legacy* resolve methods and every legacy parameter (GalaxySecretRef, GalaxyAckCredentialResolver, OpcUaUserIdentityFactory, OpcUaUserCertificatePaths, OpcUaClientSecretResolution), and IDriverDiagnostics on GalaxyDriver / OpcUaClientDriver, which only carried the tracker entries.
  • Resolve time now always goes through the existing CredentialReferences scope check. A running Galaxy driver (init, every ReopenAsync, ack fallback) and a running OpcUaClient driver (session open) refuse with CredentialReferenceException before any store, env or file read, and before any endpoint is dialled. The tracker also kept a pre-#836 absolute UserCertificatePath working; that is now refused as well.
  • Preflight and banner kept, as a hard error. The Running source and CredentialReferenceBannerModel went with the tracker. The ConfigDb scan stays because it still tells an operator something no other surface does: a Deployed finding is a driver that is not connecting, and a Draft finding is a deploy the gate will refuse (for example after restoring an old ConfigDb or importing a pre-#815 config). It also covers #835 and #836/#850. It logs one Error per finding, and the /raw banner is now alert-danger.
  • docs/security.md: the migration text now says running drivers refuse, and the warn-only section is replaced by "The compatibility window is over". .claude/rules/drivers.md and the vd03 preflight SQL comment are updated too.

Tests

  • New GalaxyDriverCredentialScopeTests (6), replacing GalaxyDriverLegacyCredentialTests: env:MX_API_KEY-style on init + reconnect, file: (file exists), out-of-namespace secret: and SECRET: (0 store reads), ack fallback refused (0 gateway calls), and a positive control.
  • New OpcUaClientDriverCredentialScopeTests (5), all via InitializeAsync: secret:otopcua/…, SECRET:opcuaclient/… and env:NOT_A_REF refused with 0 store reads and 0 endpoint opens; an absolute cert path refused; and a positive control.
  • Against the old code (tracker in place): Galaxy 5/6 fail and OpcUaClient 4/5 fail, each with "should throw CredentialReferenceException / DriverOperationRefusedException". Only the two positive controls pass there.
  • Tracker tests deleted from OpcUaClientSecretResolutionTests and OpcUaClientUserCertificatePathTests. The AdminUI preflight tests drop the Running and banner-model cases and assert the Error level.
  • Results after rebase: Driver.Galaxy.Tests 626 passed / 12 skipped, Driver.OpcUaClient.Tests 398 passed, AdminUI.Tests 2167 passed, OpcUaClient.Browser.Tests 26 passed, Runtime.Tests 1041 passed / 3 skipped, all with 0 failures. Release build of ZB.MOM.WW.OtOpcUa.slnx (--no-incremental): 0 warnings, 0 errors.

No deploy. DEV and QA ConfigDbs have no Galaxy/OpcUaClient driver (see the comment above), so nothing deployed is affected.

Done in **f0c6cf96** (master). **What changed** - `LegacyCredentialReferenceTracker` deleted, with its rate-limited WARN and the `credential-compat:<field>` diagnostics entry. Also gone: the per-driver `Legacy*` resolve methods and every `legacy` parameter (`GalaxySecretRef`, `GalaxyAckCredentialResolver`, `OpcUaUserIdentityFactory`, `OpcUaUserCertificatePaths`, `OpcUaClientSecretResolution`), and `IDriverDiagnostics` on `GalaxyDriver` / `OpcUaClientDriver`, which only carried the tracker entries. - Resolve time now always goes through the existing `CredentialReferences` scope check. A running Galaxy driver (init, every `ReopenAsync`, ack fallback) and a running OpcUaClient driver (session open) refuse with `CredentialReferenceException` before any store, env or file read, and before any endpoint is dialled. The tracker also kept a pre-#836 absolute `UserCertificatePath` working; that is now refused as well. - **Preflight and banner kept, as a hard error.** The Running source and `CredentialReferenceBannerModel` went with the tracker. The ConfigDb scan stays because it still tells an operator something no other surface does: a Deployed finding is a driver that is not connecting, and a Draft finding is a deploy the gate will refuse (for example after restoring an old ConfigDb or importing a pre-#815 config). It also covers #835 and #836/#850. It logs one Error per finding, and the `/raw` banner is now `alert-danger`. - `docs/security.md`: the migration text now says running drivers refuse, and the warn-only section is replaced by "The compatibility window is over". `.claude/rules/drivers.md` and the vd03 preflight SQL comment are updated too. **Tests** - New `GalaxyDriverCredentialScopeTests` (6), replacing `GalaxyDriverLegacyCredentialTests`: `env:MX_API_KEY`-style on init + reconnect, `file:` (file exists), out-of-namespace `secret:` and `SECRET:` (0 store reads), ack fallback refused (0 gateway calls), and a positive control. - New `OpcUaClientDriverCredentialScopeTests` (5), all via `InitializeAsync`: `secret:otopcua/…`, `SECRET:opcuaclient/…` and `env:NOT_A_REF` refused with 0 store reads and 0 endpoint opens; an absolute cert path refused; and a positive control. - **Against the old code** (tracker in place): Galaxy 5/6 fail and OpcUaClient 4/5 fail, each with "should throw CredentialReferenceException / DriverOperationRefusedException". Only the two positive controls pass there. - Tracker tests deleted from `OpcUaClientSecretResolutionTests` and `OpcUaClientUserCertificatePathTests`. The AdminUI preflight tests drop the Running and banner-model cases and assert the Error level. - Results after rebase: Driver.Galaxy.Tests 626 passed / 12 skipped, Driver.OpcUaClient.Tests 398 passed, AdminUI.Tests 2167 passed, OpcUaClient.Browser.Tests 26 passed, Runtime.Tests 1041 passed / 3 skipped, all with 0 failures. Release build of `ZB.MOM.WW.OtOpcUa.slnx` (`--no-incremental`): 0 warnings, 0 errors. No deploy. DEV and QA ConfigDbs have no Galaxy/OpcUaClient driver (see the comment above), so nothing deployed is affected.
dohertj2 commented 2026-11-13 02:57:21 -05:00
Author
Owner
Copy Link
Copy Source

Deployed to DEV vd03 + QA vq03/vq04 in c9640f5c on 2026-11-13. Boot log on all three nodes: Credential-reference preflight (lmxopcua#815/#834): every stored and deployed reference is namespaced. with no Error line from the preflight (neither tier has a Galaxy/OpcUaClient driver; the pack's ConfigDb preflight found 0 references).

Record: docs/deploy/2026-11-13-vd03-qa-to-c9640f5c.md (c0ba450d).

Deployed to DEV vd03 + QA vq03/vq04 in `c9640f5c` on 2026-11-13. Boot log on all three nodes: `Credential-reference preflight (lmxopcua#815/#834): every stored and deployed reference is namespaced.` with no Error line from the preflight (neither tier has a Galaxy/OpcUaClient driver; the pack's ConfigDb preflight found 0 references). Record: `docs/deploy/2026-11-13-vd03-qa-to-c9640f5c.md` (`c0ba450d`).
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
auto-managed
queue management
 blocked
Blocked by dependency or external hold
 cross-driver
queue management
 cross-repo
Needs coordinated change in another family repo (wire contract etc.)
 driver/abcip
queue management
 driver/ablegacy
queue management
 driver/focas
queue management
 driver/mqtt
MQTT / Sparkplug B broker-subscribe driver
 driver/opcuaclient
queue management
 driver/s7
queue management
 driver/twincat
queue management
 migrated
Migrated from a markdown backlog (2026-11 standardization)
 phase/1
queue management
 phase/2
queue management
 phase/3
queue management
 phase/4
queue management
 phase/5
queue management
 phase/6
queue management
 priority:p0
Must-have / blocking
 priority:p1
High priority
 priority:p2
Normal priority
 priority:p3
Low priority / nice to have
 queue/blocked
queue management
 queue/done
queue management
 queue/failed
queue management
 queue/in-progress
queue management
 queue/queued
queue management
 type:bug
Defect in shipped behaviour
 type:debt
Technical debt / hygiene
 type:deploy-gate
Rollout/deploy/migration step not yet done on an environment
 type:docs
Documentation work
 type:feature
Feature implementation
 type:followup
Follow-up deferred from a plan, PR or gate
 type:infra
Infrastructure and scaffolding
 type:review-finding
Unfixed finding from an architecture/code review
 type:test
Test work
No Label cross-driver priority:p2 type:followup
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
dohertj2 (dohertj2)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: dohertj2/lmxopcua#834
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?