Pick a Galaxy attribute that actually exercises the full driver stack: TestMachine_001.TestHistoryValue. Verified against the live dev-box ZB: it's Int32, writable (security_classification = Operate), and historized (HistoryExtension primitive). The query lives in `gr/queries/attributes_extended.sql` — swap to any other writable historized attribute via the same shape (`WHERE is_historized = 1 AND security_classification > 0`). Seed changes: - Tag row: FullName = TestMachine_001.TestHistoryValue (Int32 / ReadWrite) - VirtualTag renamed: `Doubled` → `MachineStatus` (Boolean), script returns `Source > 0`. Historized, so the write/subscribe exercise doubles as a historian-sink check once the alarm/write stages are enabled. - Scripted alarm predicate reads the same Source and fires on `> 50`. - Added ClusterNodeCredential(sa → p7-smoke-node) row so sp_GetCurrentGenerationForCluster's caller-binding check passes. Without this the server bootstrap fails with `Unauthorized: caller sa is not bound to NodeId p7-smoke-node`. E2E script: - Path-based NodeId defaults updated to match the new MachineStatus virtual tag. - Added optional `-Username / -Password` parameters. Anonymous sessions still get denied against Operate-classified attributes (PR 26 / docs/Security.md); supplying `-Username writeop -Password writeop123` against the dev-box GLAuth exercises the reverse-bridge stage. - Wired those credentials into every Invoke-Cli / Start-Process CLI invocation the script drives. Anonymous smoke remains 3/7 pass (probe + source read + reverse-bridge marked acl-expected INFO). A fuller run with `-Username writeop -Password writeop123` requires also enabling LDAP + a SecurityProfile that carries a UserName UserTokenPolicy — separate config step tracked alongside #124 (3-user authz matrix). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
187 lines
9.5 KiB
Transact-SQL
187 lines
9.5 KiB
Transact-SQL
-- Phase 7 live OPC UA E2E smoke seed (task #240).
|
|
--
|
|
-- Idempotent — DROP-and-recreate of one cluster's worth of test config:
|
|
-- * 1 ServerCluster ('p7-smoke')
|
|
-- * 1 ClusterNode ('p7-smoke-node')
|
|
-- * 1 ConfigGeneration (created Draft, then flipped to Published at the end)
|
|
-- * 1 Namespace (Equipment kind)
|
|
-- * 1 UnsArea / UnsLine / Equipment / Tag — Tag bound to a real Galaxy attribute
|
|
-- * 1 DriverInstance (Galaxy)
|
|
-- * 1 Script + 1 VirtualTag using it
|
|
-- * 1 Script + 1 ScriptedAlarm using it
|
|
--
|
|
-- Drop & re-create deletes ALL rows scoped to the cluster (in dependency order)
|
|
-- so re-running this script after a code change starts from a clean state.
|
|
-- Table-level CHECK constraints are validated on insert; if a constraint is
|
|
-- violated this script aborts with the offending row's column.
|
|
--
|
|
-- Usage:
|
|
-- sqlcmd -S "localhost,14330" -d OtOpcUaConfig -U sa -P "OtOpcUaDev_2026!" \
|
|
-- -i scripts/smoke/seed-phase-7-smoke.sql
|
|
|
|
SET NOCOUNT ON;
|
|
SET XACT_ABORT ON;
|
|
SET QUOTED_IDENTIFIER ON;
|
|
SET ANSI_NULLS ON;
|
|
SET ANSI_PADDING ON;
|
|
SET ANSI_WARNINGS ON;
|
|
SET ARITHABORT ON;
|
|
SET CONCAT_NULL_YIELDS_NULL ON;
|
|
|
|
DECLARE @ClusterId nvarchar(64) = 'p7-smoke';
|
|
DECLARE @NodeId nvarchar(64) = 'p7-smoke-node';
|
|
DECLARE @DrvId nvarchar(64) = 'p7-smoke-galaxy';
|
|
DECLARE @NsId nvarchar(64) = 'p7-smoke-ns';
|
|
DECLARE @AreaId nvarchar(64) = 'p7-smoke-area';
|
|
DECLARE @LineId nvarchar(64) = 'p7-smoke-line';
|
|
DECLARE @EqId nvarchar(64) = 'p7-smoke-eq';
|
|
DECLARE @EqUuid uniqueidentifier = '5B2CF10D-5B2C-4F10-B5B2-CF10D5B2CF10';
|
|
DECLARE @TagId nvarchar(64) = 'p7-smoke-tag-source';
|
|
DECLARE @VtScript nvarchar(64) = 'p7-smoke-script-vt';
|
|
DECLARE @AlScript nvarchar(64) = 'p7-smoke-script-al';
|
|
DECLARE @VtId nvarchar(64) = 'p7-smoke-vt-derived';
|
|
DECLARE @AlId nvarchar(64) = 'p7-smoke-al-overtemp';
|
|
|
|
BEGIN TRAN;
|
|
|
|
-- Wipe any prior smoke state. Order matters: child rows first.
|
|
DELETE s FROM dbo.ScriptedAlarmState s
|
|
WHERE s.ScriptedAlarmId = @AlId;
|
|
DELETE FROM dbo.ScriptedAlarm WHERE ScriptedAlarmId = @AlId;
|
|
DELETE FROM dbo.VirtualTag WHERE VirtualTagId = @VtId;
|
|
DELETE FROM dbo.Script WHERE ScriptId IN (@VtScript, @AlScript);
|
|
DELETE FROM dbo.Tag WHERE TagId = @TagId;
|
|
DELETE FROM dbo.Equipment WHERE EquipmentId = @EqId;
|
|
DELETE FROM dbo.UnsLine WHERE UnsLineId = @LineId;
|
|
DELETE FROM dbo.UnsArea WHERE UnsAreaId = @AreaId;
|
|
DELETE FROM dbo.DriverInstance WHERE DriverInstanceId = @DrvId;
|
|
DELETE FROM dbo.Namespace WHERE NamespaceId = @NsId;
|
|
DELETE FROM dbo.ConfigGeneration WHERE ClusterId = @ClusterId;
|
|
DELETE FROM dbo.ClusterNodeCredential WHERE NodeId = @NodeId;
|
|
DELETE FROM dbo.ClusterNodeGenerationState WHERE NodeId = @NodeId;
|
|
DELETE FROM dbo.ClusterNode WHERE NodeId = @NodeId;
|
|
DELETE FROM dbo.ServerCluster WHERE ClusterId = @ClusterId;
|
|
|
|
-- 1. Cluster + Node
|
|
INSERT dbo.ServerCluster(ClusterId, Name, Enterprise, Site, NodeCount, RedundancyMode, Enabled, CreatedBy)
|
|
VALUES (@ClusterId, 'P7 Smoke', 'zb', 'lab', 1, 'None', 1, 'p7-smoke');
|
|
|
|
INSERT dbo.ClusterNode(NodeId, ClusterId, RedundancyRole, Host, OpcUaPort, DashboardPort,
|
|
ApplicationUri, ServiceLevelBase, Enabled, CreatedBy)
|
|
VALUES (@NodeId, @ClusterId, 'Primary', 'localhost', 4840, 5000,
|
|
'urn:OtOpcUa:p7-smoke-node', 200, 1, 'p7-smoke');
|
|
|
|
-- sp_GetCurrentGenerationForCluster gates access by SUSER_SNAME() against
|
|
-- ClusterNodeCredential; without this binding the Server bootstrap fails with
|
|
-- `Unauthorized: caller sa is not bound to NodeId p7-smoke-node`. Dev Docker
|
|
-- SQL runs with `sa`; production deploys would rotate to a per-node login.
|
|
INSERT dbo.ClusterNodeCredential(NodeId, Kind, Value, Enabled, CreatedBy)
|
|
VALUES (@NodeId, N'SqlLogin', N'sa', 1, N'p7-smoke');
|
|
|
|
-- 2. Generation (created Draft, flipped to Published at the end so insert order
|
|
-- constraints (one Draft per cluster, etc.) don't fight us).
|
|
DECLARE @Gen bigint;
|
|
INSERT dbo.ConfigGeneration(ClusterId, Status, CreatedBy)
|
|
VALUES (@ClusterId, 'Draft', 'p7-smoke');
|
|
SET @Gen = SCOPE_IDENTITY();
|
|
|
|
-- 3. Namespace
|
|
INSERT dbo.Namespace(GenerationId, NamespaceId, ClusterId, Kind, NamespaceUri, Enabled)
|
|
VALUES (@Gen, @NsId, @ClusterId, 'Equipment', 'urn:p7-smoke:eq', 1);
|
|
|
|
-- 4. UNS hierarchy
|
|
INSERT dbo.UnsArea(GenerationId, UnsAreaId, ClusterId, Name)
|
|
VALUES (@Gen, @AreaId, @ClusterId, 'lab-floor');
|
|
|
|
INSERT dbo.UnsLine(GenerationId, UnsLineId, UnsAreaId, Name)
|
|
VALUES (@Gen, @LineId, @AreaId, 'galaxy-line');
|
|
|
|
INSERT dbo.Equipment(GenerationId, EquipmentId, EquipmentUuid, DriverInstanceId, UnsLineId,
|
|
Name, MachineCode, Enabled)
|
|
VALUES (@Gen, @EqId, @EqUuid, @DrvId, @LineId, 'reactor-1', 'p7-rx-001', 1);
|
|
|
|
-- 5. Driver — Galaxy proxy. DriverConfig JSON tells the proxy how to reach the
|
|
-- already-running OtOpcUaGalaxyHost. Secret + pipe name match
|
|
-- .local/galaxy-host-secret.txt + the OtOpcUaGalaxyHost service env.
|
|
INSERT dbo.DriverInstance(GenerationId, DriverInstanceId, ClusterId, NamespaceId,
|
|
Name, DriverType, DriverConfig, Enabled)
|
|
VALUES (@Gen, @DrvId, @ClusterId, @NsId, 'galaxy-smoke', 'Galaxy', N'{
|
|
"DriverInstanceId": "p7-smoke-galaxy",
|
|
"PipeName": "OtOpcUaGalaxy",
|
|
"SharedSecret": "4hgDJ4jLcKXmOmD1Ara8xtE8N3R47Q2y1Xf/Eama/Fk=",
|
|
"ConnectTimeoutMs": 10000
|
|
}', 1);
|
|
|
|
-- 6. One driver-sourced Tag bound to the Equipment. TagConfig is the Galaxy
|
|
-- fullRef; the EquipmentNodeWalker reads the JSON's FullName field and
|
|
-- hands that string to the Galaxy driver as the MXAccess reference.
|
|
-- Default points at TestMachine_001.TestHistoryValue — the live dev-box
|
|
-- Galaxy ships it as Int32 + writable (security_classification=Operate)
|
|
-- + historized (HistoryExtension primitive), so the E2E script can
|
|
-- exercise read + write + subscribe + alarm + history against the
|
|
-- same attribute. Swap to any other writable historized attribute on
|
|
-- this Galaxy by re-running `gr/queries/attributes_extended.sql` with
|
|
-- `WHERE is_historized=1 AND security_classification > 0`.
|
|
INSERT dbo.Tag(GenerationId, TagId, DriverInstanceId, EquipmentId, Name, DataType,
|
|
AccessLevel, TagConfig, WriteIdempotent)
|
|
VALUES (@Gen, @TagId, @DrvId, @EqId, 'Source', 'Int32', 'ReadWrite',
|
|
N'{"FullName":"TestMachine_001.TestHistoryValue","DataType":"Int32"}', 0);
|
|
|
|
-- 7. Scripts (SourceHash is SHA-256 of SourceCode, computed externally — using
|
|
-- a placeholder here; the engine recomputes on first use anyway).
|
|
--
|
|
-- MachineStatus predicate — the dynamic "is the machine running?" status
|
|
-- derived from the raw Source value. Boolean: true when Source > 0. Matches
|
|
-- the shape Aveva operators typically want on a machine-status tile (green
|
|
-- when above zero, otherwise grey) without needing a separate threshold
|
|
-- attribute. Rename + re-threshold here to mirror site semantics.
|
|
INSERT dbo.Script(GenerationId, ScriptId, Name, SourceCode, SourceHash, Language)
|
|
VALUES
|
|
(@Gen, @VtScript, 'machine-status-predicate',
|
|
N'return System.Convert.ToInt32(ctx.GetTag("/lab-floor/galaxy-line/reactor-1/Source").Value) > 0;',
|
|
'0000000000000000000000000000000000000000000000000000000000000000', 'CSharp'),
|
|
(@Gen, @AlScript, 'overtemp-predicate',
|
|
N'return System.Convert.ToInt32(ctx.GetTag("/lab-floor/galaxy-line/reactor-1/Source").Value) > 50;',
|
|
'0000000000000000000000000000000000000000000000000000000000000000', 'CSharp');
|
|
|
|
-- 8. VirtualTag — MachineStatus boolean computed by Roslyn each time Source
|
|
-- changes. Historized so the dashboard can plot a running/idle timeline
|
|
-- next to the raw TestHistoryValue trend from Aveva Historian.
|
|
INSERT dbo.VirtualTag(GenerationId, VirtualTagId, EquipmentId, Name, DataType,
|
|
ScriptId, ChangeTriggered, TimerIntervalMs, Historize, Enabled)
|
|
VALUES (@Gen, @VtId, @EqId, 'MachineStatus', 'Boolean', @VtScript, 1, NULL, 1, 1);
|
|
|
|
-- 9. ScriptedAlarm — Active when Source > 50.
|
|
INSERT dbo.ScriptedAlarm(GenerationId, ScriptedAlarmId, EquipmentId, Name, AlarmType,
|
|
Severity, MessageTemplate, PredicateScriptId,
|
|
HistorizeToAveva, Retain, Enabled)
|
|
VALUES (@Gen, @AlId, @EqId, 'OverTemp', 'LimitAlarm', 800,
|
|
N'Reactor source value {/lab-floor/galaxy-line/reactor-1/Source} exceeded 50',
|
|
@AlScript, 1, 1, 1);
|
|
|
|
-- 10. Publish — flip the generation Status. sp_PublishGeneration takes
|
|
-- concurrency locks + does ExternalIdReservation merging; we drive it via
|
|
-- EXEC rather than UPDATE so the rest of the publish workflow runs.
|
|
EXEC dbo.sp_PublishGeneration @ClusterId = @ClusterId, @DraftGenerationId = @Gen,
|
|
@Notes = N'Phase 7 live smoke — task #240';
|
|
|
|
COMMIT;
|
|
|
|
PRINT '';
|
|
PRINT 'Phase 7 smoke seed complete.';
|
|
PRINT ' Cluster: ' + @ClusterId;
|
|
PRINT ' Node: ' + @NodeId + ' (set Node:NodeId in appsettings.json)';
|
|
PRINT ' Generation: ' + CONVERT(nvarchar(20), @Gen);
|
|
PRINT '';
|
|
PRINT 'Next steps:';
|
|
PRINT ' 1. Edit src/ZB.MOM.WW.OtOpcUa.Server/appsettings.json:';
|
|
PRINT ' Node:NodeId = "p7-smoke-node"';
|
|
PRINT ' Node:ClusterId = "p7-smoke"';
|
|
PRINT ' 2. Edit the placeholder Galaxy attribute in dbo.Tag.TagConfig above';
|
|
PRINT ' so it points at a real attribute on this Galaxy — replace';
|
|
PRINT ' REPLACE_WITH_REAL_GALAXY_ATTRIBUTE with e.g. "Plant1.Reactor1.Temp".';
|
|
PRINT ' 3. Start the Server in a non-elevated shell so the Galaxy.Host pipe ACL';
|
|
PRINT ' accepts the connection:';
|
|
PRINT ' dotnet run --project src/ZB.MOM.WW.OtOpcUa.Server';
|
|
PRINT ' 4. Validate via Client.CLI per docs/v2/implementation/phase-7-e2e-smoke.md';
|