lmxopcua/src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Pages/Clusters/ClusterRedundancy.razor

@page "/clusters/{ClusterId}/redundancy"
@attribute [Authorize(Policy = AdminUiPolicies.AuthenticatedRead)]
@rendermode RenderMode.InteractiveServer
@using Microsoft.AspNetCore.Authorization
@using Microsoft.EntityFrameworkCore
@using ZB.MOM.WW.OtOpcUa.AdminUI.Redundancy
@using ZB.MOM.WW.OtOpcUa.Configuration
@using ZB.MOM.WW.OtOpcUa.Configuration.Entities
@using ZB.MOM.WW.OtOpcUa.ControlPlane.Redundancy
@inject IDbContextFactory<OtOpcUaConfigDbContext> DbFactory
@inject IManualFailoverService FailoverService
@inject AuthenticationStateProvider AuthState
@inject IAuthorizationService AuthorizationService

@if (!_loaded)
{
    <p>Loading…</p>
}
else if (_cluster is null)
{
    <section class="panel notice rise" style="animation-delay:.02s">
        Cluster <span class="mono">@ClusterId</span> was not found.
        <a class="ms-2" href="/clusters">Back to list</a>.
    </section>
}
else
{
    <div class="d-flex justify-content-between align-items-center mb-3">
        <div>
            <h4 class="mb-0">@_cluster.Name &middot; Redundancy</h4>
            <span class="mono text-muted">@_cluster.ClusterId</span>
        </div>
    </div>

    <ClusterNav ClusterId="@ClusterId" ActiveTab="redundancy" />

    <section class="panel notice rise" style="animation-delay:.02s">
        v2 redundancy is computed at runtime by <span class="mono">RedundancyStateActor</span>
        on each admin node. The values below are the static configuration; the resolved live
        <span class="mono">ServiceLevel</span> for each peer is broadcast on the
        <span class="mono">redundancy-state</span> DPS topic and consumed by the OPC UA host's
        <span class="mono">ServerStatus</span> publisher. See
        <a href="/docs/v2/Architecture-v2.md">docs/v2/Architecture-v2.md</a>.
    </section>

    <section class="card-grid rise mt-3" style="animation-delay:.08s">
        <div class="metric-card">
            <div class="panel-head">Cluster redundancy</div>
            <div class="kv"><span class="k">Mode</span><span class="v">@_cluster.RedundancyMode</span></div>
            <div class="kv"><span class="k">Node count</span><span class="v">@_cluster.NodeCount</span></div>
        </div>
    </section>

    <section class="panel rise mt-3" style="animation-delay:.11s">
        <div class="panel-head">Live redundancy</div>
        <div style="padding:1rem">
            <div class="kv">
                <span class="k">Driver Primary</span>
                <span class="v mono">@(_failover.Snapshot?.PrimaryAddress ?? "—")</span>
            </div>
            <div class="kv">
                <span class="k">Up driver members</span>
                <span class="v mono">
                    @(_failover.Snapshot is { DriverAddresses.Count: > 0 } s
                        ? string.Join(", ", s.DriverAddresses)
                        : "—")
                </span>
            </div>

            <p class="text-muted small mt-2 mb-0">
                Read live from cluster state on this node. <strong>Mesh-wide scope:</strong> the Primary is
                elected once per Akka mesh, not per cluster row — in the current single-mesh topology this
                acts on the whole mesh's Primary, which may be a node of another
                <span class="mono">Cluster</span>. See <span class="mono">docs/Redundancy.md</span>.
            </p>

            <AuthorizeView Policy="@ManualFailoverPageModel.RequiredPolicy">
                <Authorized>
                    <div class="mt-3">
                        <button class="btn btn-sm btn-outline-danger"
                                disabled="@(!_failover.CanFailOver)"
                                title="@(_failover.DisabledReason ?? "Gracefully move the driver Primary to its peer")"
                                @onclick="() => _failover.RequestFailover()">
                            Trigger failover
                        </button>
                        @if (_failover.DisabledReason is { } reason)
                        {
                            <span class="text-muted small ms-2">@reason</span>
                        }
                    </div>

                    @if (_failover.ConfirmOpen)
                    {
                        <div class="panel notice mt-3">
                            <strong>Fail over the driver Primary?</strong>
                            <ul class="mb-2 mt-2">
                                <li><span class="mono">@(_failover.Snapshot?.PrimaryAddress)</span> leaves the cluster and its process restarts.</li>
                                <li>Its peer becomes Primary and advertises <span class="mono">ServiceLevel</span> 250.</li>
                                <li>Connected OPC UA clients re-select the new Primary.</li>
                            </ul>
                            <button class="btn btn-sm btn-danger" @onclick="ConfirmFailoverAsync">Confirm failover</button>
                            <button class="btn btn-sm btn-outline-secondary ms-2" @onclick="() => _failover.CancelFailover()">Cancel</button>
                        </div>
                    }
                </Authorized>
            </AuthorizeView>

            @if (_failover.StatusMessage is { } msg)
            {
                <div class="mt-3 @(_failover.StatusIsError ? "text-danger" : "text-success")">@msg</div>
            }
        </div>
    </section>

    <section class="panel rise mt-3" style="animation-delay:.14s">
        <div class="panel-head">Node service-level configuration</div>
        @if (_nodes is null || _nodes.Count == 0)
        {
            <div style="padding:1rem" class="text-muted">No nodes registered.</div>
        }
        else
        {
            <div class="table-wrap">
                <table class="data-table">
                    <thead>
                        <tr>
                            <th>Node ID</th>
                            <th>ApplicationUri</th>
                            <th class="num">ServiceLevel base</th>
                            <th>Notes</th>
                        </tr>
                    </thead>
                    <tbody>
                        @foreach (var n in _nodes)
                        {
                            <tr>
                                <td><span class="mono">@n.NodeId</span></td>
                                <td><span class="mono small">@n.ApplicationUri</span></td>
                                <td class="num">@n.ServiceLevelBase</td>
                                <td class="text-muted small">
                                    @if (n.ServiceLevelBase >= 200) { <text>Primary preference</text> }
                                    else if (n.ServiceLevelBase >= 100) { <text>Secondary preference</text> }
                                    else { <text>Custom</text> }
                                </td>
                            </tr>
                        }
                    </tbody>
                </table>
            </div>
        }
    </section>
}

@code {
    [Parameter] public string ClusterId { get; set; } = "";

    private bool _loaded;
    private ServerCluster? _cluster;
    private List<ClusterNode>? _nodes;

    // Everything consequential about the failover control (peer guard, confirm flow, outcome text)
    // lives in this pure model rather than in the markup — the repo has no bUnit, so logic left in a
    // .razor is verified only by driving the page. Covered by ManualFailoverPageModelTests.
    private ManualFailoverPageModel _failover = default!;

    protected override async Task OnInitializedAsync()
    {
        _failover = new ManualFailoverPageModel(FailoverService);
        _failover.Refresh();

        await using var db = await DbFactory.CreateDbContextAsync();
        _cluster = await db.ServerClusters.AsNoTracking()
            .FirstOrDefaultAsync(c => c.ClusterId == ClusterId);
        if (_cluster is not null)
        {
            _nodes = await db.ClusterNodes.AsNoTracking()
                .Where(n => n.ClusterId == ClusterId)
                .OrderBy(n => n.NodeId)
                .ToListAsync();
        }
        _loaded = true;
    }

    /// <summary>
    /// Defense-in-depth: the button is FleetAdmin-gated in markup, but this handler runs on the
    /// server circuit — re-check the policy before bouncing a production node (the same pattern the
    /// certificate-store actions use).
    /// </summary>
    private async Task ConfirmFailoverAsync()
    {
        var authState = await AuthState.GetAuthenticationStateAsync();
        if (!(await AuthorizationService.AuthorizeAsync(
                authState.User, null, ManualFailoverPageModel.RequiredPolicy)).Succeeded)
        {
            _failover.CancelFailover();
            return;
        }

        await _failover.ConfirmFailoverAsync(authState.User.Identity?.Name ?? "system");
    }
}