Joseph Doherty
8e8d4cdf13
The native-ack path is fire-and-forget after the Part 9 Acknowledge returns, so a Galaxy ack refused for lack of a credential (#749), or rejected by MXAccess, left the client with Good and the condition showing Acknowledged while Galaxy was never acked. Both options from the issue, layered: 1. Synchronous refusal for what the driver can decide without I/O. New optional IAlarmAcknowledgePreflight (Core.Abstractions); GalaxyDriver refuses an anonymous session when the driver has no AlarmAck fallback account. DriverHostActor publishes a condition NodeId -> owning-driver snapshot into NativeAlarmAckPreflightView (lock-free, volatile); the node manager's new NativeAlarmAckPreflight seam, consulted after the authz and Primary gates, returns BadUserAccessDenied with the reason - nothing routed, applied or reported. A keyed session is not pre-checked (its identity lives in the Secrets store, which must not be read under the SDK lock). 2. Revert for everything else. RouteAlarmAck carries the condition NodeId; DriverInstanceActor replies AlarmAckFailed on a refusal, a backend failure, a driver without an alarm source, or an ack dropped while connecting / reconnecting. DriverHostActor re-projects the condition unacknowledged via NativeAlarmProjector.TryRevertAcknowledge, but only while the local ack is still pending - any driver transition projected since then wins. A disabled or unspawned driver is not reverted (unchanged). GatewayGalaxyAlarmAcknowledger now throws DriverOperationRefusedException on a non-zero native hresult (wrong password, no ack permission) instead of only warning, so that case reverts too; as a refusal it neither retries nor trips the breaker. Tests (each fails with its fix mutated out): projector revert/supersede, DriverHostActor refused + failed ack -> unacked AlarmStateUpdate (successful ack control), preflight view snapshot, node-manager preflight unit test, over-the-wire ConditionMethodEventTests (BadUserAccessDenied, no route, no event; positive control), Galaxy preflight + hresult refusal. Docs: Galaxy.md, AlarmTracking.md, ScriptedAlarms.md, .claude/rules/alarms.md. Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV
25 lines
1.4 KiB
C#
25 lines
1.4 KiB
C#
namespace ZB.MOM.WW.OtOpcUa.Core.Abstractions;
|
|
|
|
/// <summary>
|
|
/// Optional companion to <see cref="IAlarmSource"/>: lets the OPC UA Part 9 <c>Acknowledge</c> method
|
|
/// refuse, with a synchronous status, an acknowledge the driver already knows it would refuse
|
|
/// (lmxopcua#760). The native ack path is otherwise fire-and-forget after the method returns, so without
|
|
/// this the client sees <c>Good</c> for an acknowledge that never reached the upstream alarm system.
|
|
/// </summary>
|
|
/// <remarks>
|
|
/// Called on an OPC UA server thread, under the SDK node-manager lock: an implementation must answer from
|
|
/// state it already holds — no I/O, no secret lookups, no blocking. It is a best-effort pre-check for
|
|
/// static misconfiguration only; an acknowledge it lets through can still fail later (that path reverts
|
|
/// the condition to unacknowledged instead).
|
|
/// </remarks>
|
|
public interface IAlarmAcknowledgePreflight
|
|
{
|
|
/// <summary>
|
|
/// Returns why an acknowledge from a session that authenticated with <paramref name="apiKeyId"/> would
|
|
/// be refused, or <c>null</c> when it would proceed or the driver cannot tell without I/O.
|
|
/// </summary>
|
|
/// <param name="apiKeyId">The session's API key id, or null for an anonymous session.</param>
|
|
/// <returns>A refusal reason safe to show the OPC UA client (never a secret), or null.</returns>
|
|
string? GetAcknowledgeRefusal(string? apiKeyId);
|
|
}
|