Resolve Server-002, -004, -005, -006 code-review findings

Server-002: the gateway never terminated leftover MxGateway.Worker.exe processes at startup, contradicting gateway.md and CLAUDE.md. Added IRunningProcessInspector/SystemRunningProcessInspector, OrphanWorkerTerminator, and OrphanWorkerCleanupHostedService (best-effort, runs before sessions are accepted); updated gateway.md to describe the implemented behavior. Server-004: API-key scopes were persisted verbatim with no validation. Added GatewayScopes.All/IsKnown; the CLI parser and dashboard create path now reject unknown scope strings. Server-005: a non-SqlException/InvalidOperationException fault on the initial Galaxy hierarchy load faulted the BackgroundService. ExecuteAsync now catches all non-cancellation exceptions on first load and RefreshCoreAsync broadens its catch so the cache records Stale/Unavailable instead. Server-006: OpenSessionAsync incremented the open-sessions gauge before alarm auto-subscribe; an auto-subscribe failure leaked the gauge. The catch path now calls SessionRemoved() when the gauge was incremented. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-18 21:31:10 -04:00
parent 5e795aeeb8
commit 1d9e3afadd
18 changed files with 676 additions and 15 deletions
@@ -52,6 +52,56 @@ public sealed class ApiKeyAdminCommandLineParserTests
        Assert.Contains("events:read", result.Command.Scopes);
    }

+    /// <summary>
+    ///     Server-004 regression: a create-key command with a non-canonical scope
+    ///     string (e.g. CLAUDE.md's stale <c>invoke</c> instead of <c>invoke:read</c>)
+    ///     must be rejected at parse time rather than silently persisting an
+    ///     unusable scope the authorization resolver never matches.
+    /// </summary>
+    [Fact]
+    public void Parse_CreateKeyCommand_RejectsUnknownScope()
+    {
+        ApiKeyAdminParseResult result = ApiKeyAdminCommandLineParser.Parse(
+            [
+                "apikey",
+                "create-key",
+                "--key-id",
+                "operator01",
+                "--display-name",
+                "Operator",
+                "--scopes",
+                "session:open,invoke,metadata",
+            ]);
+
+        Assert.True(result.IsApiKeyCommand);
+        Assert.Null(result.Command);
+        Assert.NotNull(result.Error);
+        Assert.Contains("invoke", result.Error, StringComparison.Ordinal);
+        Assert.Contains("metadata", result.Error, StringComparison.Ordinal);
+    }
+
+    /// <summary>Verifies a create-key command with only canonical scopes parses successfully.</summary>
+    [Fact]
+    public void Parse_CreateKeyCommand_AcceptsAllCanonicalScopes()
+    {
+        ApiKeyAdminParseResult result = ApiKeyAdminCommandLineParser.Parse(
+            [
+                "apikey",
+                "create-key",
+                "--key-id",
+                "operator01",
+                "--display-name",
+                "Operator",
+                "--scopes",
+                "session:open,session:close,invoke:read,invoke:write,invoke:secure,events:read,metadata:read,admin",
+            ]);
+
+        Assert.True(result.IsApiKeyCommand);
+        Assert.Null(result.Error);
+        Assert.NotNull(result.Command);
+        Assert.Equal(8, result.Command.Scopes.Count);
+    }
+
    /// <summary>
    /// Verifies create key without display name returns error.
    /// </summary>