Joseph Doherty
29 lines
1.7 KiB
C#
29 lines
1.7 KiB
C#
using ZB.MOM.WW.OtOpcUa.Commons.Messages.Redundancy;
|
|
|
|
namespace ZB.MOM.WW.OtOpcUa.Runtime.Drivers;
|
|
|
|
/// <summary>
|
|
/// Single decision point for the Primary data-plane gates (inbound device writes, native alarm acks,
|
|
/// fleet-wide alerts publishes). A KNOWN role wins outright; an UNKNOWN role (no redundancy snapshot
|
|
/// yet, or the snapshot never mentioned this node — the 03/S5 identity-mismatch shape) is resolved by
|
|
/// cluster membership: a single-driver cluster stays default-ALLOW (no peer exists — the
|
|
/// boot-window / single-node posture), a multi-driver cluster is default-DENY (a real Primary peer
|
|
/// exists; do not touch the shared field device until the redundancy snapshot proves this node is it).
|
|
/// Fixes archreview 03/S4 (primary gate defaulted to allow while role unknown → dual-primary window).
|
|
/// </summary>
|
|
public static class PrimaryGatePolicy
|
|
{
|
|
/// <summary>Decide whether this node should service a Primary-only data-plane operation.</summary>
|
|
/// <param name="localRole">This node's last-known redundancy role, or <c>null</c> when unknown
|
|
/// (no snapshot received yet, or the snapshot omitted this node).</param>
|
|
/// <param name="driverMemberCount">Count of Up cluster members carrying the <c>driver</c> role.</param>
|
|
/// <returns><c>true</c> to service as Primary; <c>false</c> to deny.</returns>
|
|
public static bool ShouldServiceAsPrimary(RedundancyRole? localRole, int driverMemberCount) =>
|
|
localRole switch
|
|
{
|
|
RedundancyRole.Primary => true,
|
|
RedundancyRole.Secondary or RedundancyRole.Detached => false,
|
|
_ => driverMemberCount <= 1, // unknown: allow only when no driver peer exists
|
|
};
|
|
}
|