Not authorized for this session's events.
+ }
+ else if (_recentEvents.Count == 0)
{
Waiting for events. The dashboard subscribes to this session's events directly, so
@@ -175,6 +180,10 @@ else
private CancellationTokenSource? _eventPumpCancellation;
private Task? _eventPumpTask;
private bool _eventsConnected;
+ // Renders the denial message in place of the events panel's empty state. Starts true so the
+ // panel reads as "waiting" until the gate has actually been evaluated for a session id;
+ // AttachEventsAsync is the only writer, and it writes on the renderer's dispatcher.
+ private bool _eventsAuthorized = true;
private string? _subscribedSessionId;
private readonly LinkedList
_recentEvents = new();
@@ -203,7 +212,7 @@ else
// renderer's dispatcher so the new subscription is published to
// _eventSubscription from the same thread the pump's guard reads it on.
await DetachEventsAsync();
- AttachEvents();
+ await AttachEventsAsync();
}
}
@@ -288,19 +297,34 @@ else
// IDashboardEventBroadcaster, and the subscription registers with
// EventsHubViewerRegistry, so the "nobody is watching" gate keeps working for
// both audiences.
- // ACL posture is unchanged from the hub path: any dashboard Viewer may watch
- // any session (SEC-25 tracks the per-session ACL for both seams).
- private void AttachEvents()
+ // ACL posture matches the hub path exactly: IDashboardSessionAcl gates this seam with the
+ // same decision EventsHub.SubscribeSession applies (SEC-25 / TST-15). The gate wraps only
+ // whether a subscription is created at all — the generation guards, the pump, and the detach
+ // coupling below it are untouched, so a denied page holds no subscription to leak and never
+ // registers a viewer, which keeps the broadcaster's mirror off for that session.
+ private async Task AttachEventsAsync()
{
if (string.IsNullOrWhiteSpace(SessionId))
{
return;
}
+ // Deliberately no ConfigureAwait(false): the decision and everything it publishes must
+ // land back on the renderer's dispatcher, which is where the fields below are owned.
+ AuthenticationState authenticationState = await AuthenticationStateProvider.GetAuthenticationStateAsync();
+
+ _subscribedSessionId = SessionId;
+ _eventsAuthorized = SessionAcl.CanViewSession(authenticationState.User, SessionId);
+
+ if (!_eventsAuthorized)
+ {
+ // No subscription, no pump, no viewer registration — the panel renders the denial.
+ return;
+ }
+
_eventSubscription = EventSubscriber.Subscribe(SessionId);
_eventPumpCancellation = new CancellationTokenSource();
_eventsConnected = true;
- _subscribedSessionId = SessionId;
// Deliberately not awaited: the pump runs for as long as the page watches this
// session and is cancelled and drained by DetachEventsAsync.
diff --git a/src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardActiveAlarm.cs b/src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardActiveAlarm.cs
index 90708e2..fe3a76f 100644
--- a/src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardActiveAlarm.cs
+++ b/src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardActiveAlarm.cs
@@ -57,7 +57,14 @@ public sealed record DashboardActiveAlarm(
/// The active alarms, or an empty list on error.
/// A diagnostic message when the query failed; otherwise null.
/// The worker process id backing the dashboard session, when available.
+///
+/// True when the provider fetch behind hit its per-fetch cap, so the
+/// list may be missing active alarms. Distinct from : the query
+/// succeeded and every row shown is real — only the set's completeness is in doubt, which the
+/// page states as a caveat rather than a failure.
+///
public sealed record DashboardAlarmQueryResult(
IReadOnlyList Alarms,
string? Error,
- int? WorkerProcessId);
+ int? WorkerProcessId,
+ bool SnapshotTruncated = false);
diff --git a/src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardAuthenticationDefaults.cs b/src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardAuthenticationDefaults.cs
index f00caf3..7f00a59 100644
--- a/src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardAuthenticationDefaults.cs
+++ b/src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardAuthenticationDefaults.cs
@@ -36,6 +36,16 @@ public static class DashboardAuthenticationDefaults
public const string LdapGroupClaimType = "mxgateway:ldap_group";
public const string KeyPrefixClaimType = "mxgateway:key_prefix";
+ ///
+ /// Claim carrying one dashboard event-visibility tag the caller is granted (SEC-25). Stamped
+ /// at cookie login by and at hub-token mint by
+ /// , both resolving the caller's LDAP groups through
+ /// MxGateway:Dashboard:GroupToTag; read by . A
+ /// principal carrying none of these claims is an empty-grant Viewer, which is the fail-closed
+ /// default. Visibility only — it never grants data access.
+ ///
+ public const string DashboardTagClaimType = "zb:dashboardtag";
+
///
/// Dashboard auth cookie name used when the cookie is not guaranteed to be Secure
/// (RequireHttpsCookie=false → )
diff --git a/src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardAuthenticator.cs b/src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardAuthenticator.cs
index 4ad86fe..8250990 100644
--- a/src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardAuthenticator.cs
+++ b/src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardAuthenticator.cs
@@ -1,7 +1,9 @@
using System.Security.Claims;
+using Microsoft.Extensions.Options;
using ZB.MOM.WW.Auth.Abstractions.Ldap;
using ZB.MOM.WW.Auth.Abstractions.Roles;
using ZB.MOM.WW.Auth.AspNetCore;
+using ZB.MOM.WW.MxGateway.Server.Configuration;
namespace ZB.MOM.WW.MxGateway.Server.Dashboard;
@@ -17,10 +19,15 @@ namespace ZB.MOM.WW.MxGateway.Server.Dashboard;
///
/// Shared LDAP bind-then-search provider.
/// Maps LDAP groups to dashboard roles.
+///
+/// Gateway options supplying MxGateway:Dashboard:GroupToTag, the map that turns the user's
+/// LDAP groups into the dashboard visibility tags stamped on the cookie principal (SEC-25).
+///
/// Logger for diagnostic, credential-free login outcomes.
public sealed class DashboardAuthenticator(
ILdapAuthService ldapAuthService,
IGroupRoleMapper roleMapper,
+ IOptions options,
ILogger logger) : IDashboardAuthenticator
{
private const string GenericFailureMessage = "The username or password is invalid, or the user is not authorized.";
@@ -70,7 +77,8 @@ public sealed class DashboardAuthenticator(
ldapResult.Username,
ldapResult.DisplayName,
ldapResult.Groups,
- roles));
+ roles,
+ options.Value.Dashboard.GroupToTag));
}
///
@@ -97,12 +105,23 @@ public sealed class DashboardAuthenticator(
/// is role-based), so the shape change is non-breaking for dashboard consumers.
///
/// The dashboard roles resolved from .
+ ///
+ /// The configured Dashboard:GroupToTag map. The tags it grants are stamped as
+ /// claims so a
+ /// cookie-authenticated circuit carries its grant without a hub-token round-trip — the
+ /// session-details page's in-process subscribe seam reads exactly these claims.
+ ///
private static ClaimsPrincipal CreatePrincipal(
string username,
string displayName,
IEnumerable groups,
- IEnumerable roles)
+ IEnumerable roles,
+ IReadOnlyDictionary groupToTag)
{
+ // Materialized because the groups are read twice below (group claims and tag mapping) and
+ // the source is only guaranteed to be enumerable.
+ string[] groupNames = groups as string[] ?? [.. groups];
+
List claims =
[
// Keep NameIdentifier so any existing read-site that uses it continues to work.
@@ -120,9 +139,14 @@ public sealed class DashboardAuthenticator(
// Groups are short RDN names from ILdapAuthService (see param doc above), so
// this claim value is the short group name, not the original DN.
// LdapGroupClaimType is MxGateway-specific ("mxgateway:ldap_group") — no ZbClaimType for groups.
- claims.AddRange(groups.Select(group => new Claim(
+ claims.AddRange(groupNames.Select(group => new Claim(
DashboardAuthenticationDefaults.LdapGroupClaimType,
group)));
+ // Dashboard event-visibility tags (SEC-25). Visibility only — never a data-access grant —
+ // and never logged: only the decision, never the tag values, reaches diagnostics.
+ claims.AddRange(DashboardGroupTagMapping
+ .MapGroupsToTags(groupNames, groupToTag)
+ .Select(tag => new Claim(DashboardAuthenticationDefaults.DashboardTagClaimType, tag)));
ClaimsIdentity claimsIdentity = new(
claims,
diff --git a/src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardLiveDataService.cs b/src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardLiveDataService.cs
index ec2aa2e..6e7e2c2 100644
--- a/src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardLiveDataService.cs
+++ b/src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardLiveDataService.cs
@@ -127,7 +127,11 @@ public sealed class DashboardLiveDataService : IDashboardLiveDataService, IAsync
? null
: _alarmService.LastError ?? $"Alarm monitor is {_alarmService.State}.";
- return Task.FromResult(new DashboardAlarmQueryResult(alarms, error, _alarmService.WorkerProcessId));
+ return Task.FromResult(new DashboardAlarmQueryResult(
+ alarms,
+ error,
+ _alarmService.WorkerProcessId,
+ _alarmService.SnapshotTruncated));
}
// Promotes every already-advised tag in this read to the front of the recency
diff --git a/src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardServiceCollectionExtensions.cs b/src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardServiceCollectionExtensions.cs
index 83ef2d1..f9367d9 100644
--- a/src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardServiceCollectionExtensions.cs
+++ b/src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardServiceCollectionExtensions.cs
@@ -45,6 +45,10 @@ public static class DashboardServiceCollectionExtensions
services.AddSingleton();
services.AddSingleton();
services.AddSingleton();
+ // Singleton and stateless: it reads the session registry and options per call, and is
+ // consulted from both subscribe seams (the EventsHub join and the session-details page's
+ // in-process subscription).
+ services.AddSingleton();
// Singleton, and the only consumer scope left is HubTokenAuthenticationHandler plus
// the /hubs/token endpoint: server-rendered pages read the in-process feeds, so
// nothing in this process builds a hub connection or needs a token for one.
diff --git a/src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardSessionAcl.cs b/src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardSessionAcl.cs
new file mode 100644
index 0000000..6a28aec
--- /dev/null
+++ b/src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardSessionAcl.cs
@@ -0,0 +1,85 @@
+using System.Security.Claims;
+using Microsoft.Extensions.Options;
+using ZB.MOM.WW.MxGateway.Server.Configuration;
+using ZB.MOM.WW.MxGateway.Server.Sessions;
+
+namespace ZB.MOM.WW.MxGateway.Server.Dashboard;
+
+///
+/// Tag-intersection implementation of . Fails closed on
+/// every branch: an unknown session, an empty tag grant, and an untagged session under the
+/// default all deny.
+///
+///
+///
+/// Decision order (first match wins):
+///
+///
+/// - Authenticated caller in → allow. Admin
+/// already reaches every destructive surface, so event-metadata visibility is strictly weaker.
+/// - Session not present in → deny. No subscription
+/// is created for a phantom id.
+/// - Session carries no tags → allow only when
+/// MxGateway:Dashboard:UntaggedSessionVisibility is
+/// .
+/// - Otherwise allow iff the session's tags intersect the caller's granted tags
+/// (ordinal-ignore-case).
+///
+///
+/// Granted tags are read from the caller's
+/// claims, stamped at login () or at hub-token mint
+/// (). A principal with no such claims — anonymous localhost included —
+/// is an empty-grant Viewer.
+///
+///
+/// This sits on the subscribe path, not the per-event path, and must stay cheap enough to
+/// keep it there: the only per-call work is the claim scan plus a session-registry lookup, with no
+/// intermediate collection built. A per-event re-check is deliberately not needed — a joined SignalR
+/// group and an in-process subscription are both per-session, and
+/// is immutable for the session's life, so the decision taken at subscribe time cannot go stale
+/// while the subscription lives.
+///
+///
+/// Registry the session id is resolved against.
+/// Gateway options supplying Dashboard:UntaggedSessionVisibility.
+public sealed class DashboardSessionAcl(
+ ISessionManager sessionManager,
+ IOptions options) : IDashboardSessionAcl
+{
+ ///
+ public bool CanViewSession(ClaimsPrincipal? principal, string sessionId)
+ {
+ if (principal is null || string.IsNullOrWhiteSpace(sessionId))
+ {
+ return false;
+ }
+
+ if (principal.Identity?.IsAuthenticated == true && principal.IsInRole(DashboardRoles.Admin))
+ {
+ return true;
+ }
+
+ if (!sessionManager.TryGetSession(sessionId, out GatewaySession? session))
+ {
+ return false;
+ }
+
+ if (session.Tags.Count == 0)
+ {
+ return options.Value.Dashboard.UntaggedSessionVisibility == UntaggedSessionVisibility.AllViewers;
+ }
+
+ // Session.Tags is an ordinal-ignore-case set, so the containment test carries the
+ // comparison; scanning the claims (rather than materializing the grant) keeps this
+ // allocation-free beyond the claim enumerator.
+ foreach (Claim tagClaim in principal.FindAll(DashboardAuthenticationDefaults.DashboardTagClaimType))
+ {
+ if (session.Tags.Contains(tagClaim.Value))
+ {
+ return true;
+ }
+ }
+
+ return false;
+ }
+}
diff --git a/src/ZB.MOM.WW.MxGateway.Server/Dashboard/HubTokenService.cs b/src/ZB.MOM.WW.MxGateway.Server/Dashboard/HubTokenService.cs
index 1ea957b..5985374 100644
--- a/src/ZB.MOM.WW.MxGateway.Server/Dashboard/HubTokenService.cs
+++ b/src/ZB.MOM.WW.MxGateway.Server/Dashboard/HubTokenService.cs
@@ -2,14 +2,16 @@ using System.Security.Claims;
using System.Security.Cryptography;
using System.Text.Json;
using Microsoft.AspNetCore.DataProtection;
+using Microsoft.Extensions.Options;
+using ZB.MOM.WW.MxGateway.Server.Configuration;
namespace ZB.MOM.WW.MxGateway.Server.Dashboard;
///
/// Mints and validates short-lived bearer tokens for SignalR hub connections.
-/// The token is a data-protected JSON payload containing the user's name and
-/// role claims. Validity is enforced by the data-protection time-limited
-/// protector; no separate signing keys are configured.
+/// The token is a data-protected JSON payload containing the user's name, role
+/// claims, and granted dashboard visibility tags. Validity is enforced by the
+/// data-protection time-limited protector; no separate signing keys are configured.
///
///
/// This service is registered as a singleton in
@@ -32,24 +34,33 @@ public sealed class HubTokenService
// Hub bearer tokens are single-purpose, data-protection-encrypted, and NOT server-side
// revocable. A short lifetime bounds the exposure window of a token captured from a proxy
// or log after logout (the cookie is cleared on logout, but outstanding tokens are not), and
- // bounds how long a stale role set survives a role change. Five minutes is transparent to
- // clients that re-fetch from /hubs/token on every (re)connect, which is what a remote hub
- // consumer is expected to do; see docs/GatewayDashboardDesign.md. Heavier jti-denylist
- // revocation is deliberately deferred until per-session hub ACLs land, when tokens gain
- // session binding.
+ // bounds how long a stale role set survives a role change. It now bounds a stale *tag* grant
+ // the same way (SEC-25): the token carries the tags resolved from the caller's LDAP groups at
+ // mint time, so revoking a GroupToTag entry takes effect for token-authenticated hub
+ // connections within one lifetime — the natural place the deferred "tokens gain session
+ // binding" note landed. Five minutes is transparent to clients that re-fetch from /hubs/token
+ // on every (re)connect, which is what a remote hub consumer is expected to do; see
+ // docs/GatewayDashboardDesign.md. Heavier jti-denylist revocation stays deferred.
internal static readonly TimeSpan TokenLifetime = TimeSpan.FromMinutes(5);
private readonly ITimeLimitedDataProtector _protector;
+ private readonly IOptions _options;
/// Initializes a new instance of the HubTokenService with a data protection provider.
/// The data protection provider for token encryption.
- public HubTokenService(IDataProtectionProvider dataProtection)
+ ///
+ /// Gateway options supplying MxGateway:Dashboard:GroupToTag, the map used to resolve the
+ /// caller's granted visibility tags at mint time.
+ ///
+ public HubTokenService(IDataProtectionProvider dataProtection, IOptions options)
{
ArgumentNullException.ThrowIfNull(dataProtection);
+ ArgumentNullException.ThrowIfNull(options);
_protector = dataProtection.CreateProtector(ProtectorPurpose).ToTimeLimitedDataProtector();
+ _options = options;
}
- /// Issues a bearer token carrying the user's identity and roles.
+ /// Issues a bearer token carrying the user's identity, roles, and granted tags.
/// The claims principal representing the user.
/// The data-protected bearer token string.
public string Issue(ClaimsPrincipal user) => Issue(user, TokenLifetime);
@@ -65,10 +76,20 @@ public sealed class HubTokenService
internal string Issue(ClaimsPrincipal user, TimeSpan lifetime)
{
ArgumentNullException.ThrowIfNull(user);
+
+ // Resolved from the caller's LDAP-group claims rather than copied from any tag claims the
+ // principal already carries: re-resolving is what makes the 5-minute lifetime an actual
+ // staleness bound on the grant. Tags are stamped for every caller — an Administrator
+ // bypasses the ACL, so theirs are simply moot rather than a special case here.
+ IReadOnlySet grantedTags = DashboardGroupTagMapping.MapGroupsToTags(
+ user.FindAll(DashboardAuthenticationDefaults.LdapGroupClaimType).Select(c => c.Value),
+ _options.Value.Dashboard.GroupToTag);
+
HubTokenPayload payload = new(
user.Identity?.Name,
user.FindFirstValue(ClaimTypes.NameIdentifier),
- [.. user.FindAll(ClaimTypes.Role).Select(c => c.Value)]);
+ [.. user.FindAll(ClaimTypes.Role).Select(c => c.Value)],
+ [.. grantedTags]);
return _protector.Protect(JsonSerializer.Serialize(payload), lifetime);
}
@@ -107,6 +128,12 @@ public sealed class HubTokenService
}
claims.AddRange((payload.Roles ?? []).Select(r => new Claim(ClaimTypes.Role, r)));
+ // Rehydrated alongside the roles so the reconstructed principal is what
+ // IDashboardSessionAcl reads on the hub path — a token minted before the tag field
+ // existed (or by a caller with no grant) simply yields an empty grant, which denies.
+ claims.AddRange((payload.Tags ?? []).Select(t => new Claim(
+ DashboardAuthenticationDefaults.DashboardTagClaimType,
+ t)));
ClaimsIdentity identity = new(
claims,
@@ -121,5 +148,5 @@ public sealed class HubTokenService
}
}
- private sealed record HubTokenPayload(string? Name, string? NameIdentifier, string[]? Roles);
+ private sealed record HubTokenPayload(string? Name, string? NameIdentifier, string[]? Roles, string[]? Tags);
}
diff --git a/src/ZB.MOM.WW.MxGateway.Server/Dashboard/Hubs/EventsHub.cs b/src/ZB.MOM.WW.MxGateway.Server/Dashboard/Hubs/EventsHub.cs
index 53c5c1c..601fabc 100644
--- a/src/ZB.MOM.WW.MxGateway.Server/Dashboard/Hubs/EventsHub.cs
+++ b/src/ZB.MOM.WW.MxGateway.Server/Dashboard/Hubs/EventsHub.cs
@@ -15,8 +15,11 @@ namespace ZB.MOM.WW.MxGateway.Server.Dashboard.Hubs;
/// registry to skip all mirror work for sessions nobody is watching.
///
/// Registry tracking which sessions have live subscribers.
+/// Per-session visibility gate consulted before any group join.
[Authorize(Policy = DashboardAuthenticationDefaults.HubClientsPolicy)]
-public sealed class EventsHub(EventsHubViewerRegistry viewerRegistry) : Hub
+public sealed class EventsHub(
+ EventsHubViewerRegistry viewerRegistry,
+ IDashboardSessionAcl sessionAcl) : Hub
{
/// Method name used to push individual MxEvent values to clients.
public const string EventMessage = "MxEvent";
@@ -33,27 +36,21 @@ public sealed class EventsHub(EventsHubViewerRegistry viewerRegistry) : Hub
/// client.
///
///
- /// In v1 the hub-level
- /// (HubClientsPolicy) only checks that the caller carries one of
- /// the dashboard roles (Admin or Viewer); both roles may subscribe to
- /// any session id they choose. This is acceptable today because (a) the
- /// dashboard's per-session views show non-secret session metadata that
- /// any authenticated dashboard user can already see, and (b) tag values
- /// are stripped from the mirrored events by
- /// when
- /// MxGateway:Dashboard:ShowTagValues is false (the default), so the
- /// most sensitive payload cannot leak through this seam regardless of the
- /// still-missing ACL. The per-session ACL that gates the gRPC
- /// StreamEvents RPC is intentionally not yet mirrored here.
- /// TODO(per-session-acl): tracked as remediation roadmap item 12
- /// (SEC-25). Once a role/scope is introduced that scopes a Viewer to a
- /// specific session or tenant, add a session-access check at this seam —
- /// either inline (consult the per-user allowed-session set on
- /// Context.User claims / Context.Items) or via a dedicated
- /// authorization policy applied to the hub method itself.
+ /// The hub-level (HubClientsPolicy)
+ /// only checks that the caller carries one of the dashboard roles, which by
+ /// itself would let any Viewer subscribe to any session id they name. The
+ /// per-session decision is 's
+ /// (SEC-25 / TST-15): Administrators see every session, a Viewer sees a
+ /// session only when its tags intersect their granted tags, and an unknown
+ /// session id is denied. A denied caller is not joined to the group and is
+ /// not registered with , so the mirror
+ /// stays off for a session nobody is legitimately watching. The same ACL
+ /// gates the in-process seam used by the session-details page, so neither
+ /// path is the weaker one.
///
/// Session id to subscribe the caller to.
/// A task representing the subscription operation.
+ /// The caller may not observe this session.
public Task SubscribeSession(string sessionId)
{
if (string.IsNullOrWhiteSpace(sessionId))
@@ -61,6 +58,13 @@ public sealed class EventsHub(EventsHubViewerRegistry viewerRegistry) : Hub
return Task.CompletedTask;
}
+ if (!sessionAcl.CanViewSession(Context.User, sessionId))
+ {
+ // Surfaced rather than swallowed so a client can tell "denied" from "no events yet".
+ // The message names neither the session's tags nor the caller's grant.
+ throw new HubException("Not authorized for this session.");
+ }
+
// Register before joining the group: the reverse order would leave a window
// in which this connection is a group member but the broadcaster's gate still
// reports the session unwatched, silently dropping events it should receive.
diff --git a/src/ZB.MOM.WW.MxGateway.Server/Dashboard/IDashboardSessionAcl.cs b/src/ZB.MOM.WW.MxGateway.Server/Dashboard/IDashboardSessionAcl.cs
new file mode 100644
index 0000000..5ae4f87
--- /dev/null
+++ b/src/ZB.MOM.WW.MxGateway.Server/Dashboard/IDashboardSessionAcl.cs
@@ -0,0 +1,33 @@
+using System.Security.Claims;
+
+namespace ZB.MOM.WW.MxGateway.Server.Dashboard;
+
+///
+/// Decides whether a dashboard principal may observe one session's mirrored
+/// event stream (SEC-25 / TST-15). Consulted at every subscribe seam: the
+/// SignalR EventsHub.SubscribeSession join and the in-process
+/// IDashboardSessionEventSubscriber.Subscribe used by the
+/// session-details page.
+///
+///
+/// The dashboard authenticates LDAP users while sessions are owned by API keys —
+/// two disjoint identity domains — so the bridge is the session tag: a
+/// session inherits its owning key's tags, and a dashboard group grants tags via
+/// MxGateway:Dashboard:GroupToTag. See
+/// docs/plans/2026-07-10-dashboard-session-acl-tst15.md.
+///
+public interface IDashboardSessionAcl
+{
+ ///
+ /// Returns whether may observe the events of the
+ /// session identified by .
+ ///
+ ///
+ /// The dashboard caller. , unauthenticated, or claim-less
+ /// principals (including the anonymous-localhost path) are treated as Viewers
+ /// holding an empty tag grant.
+ ///
+ /// Session id the caller wants to observe.
+ /// when the caller may observe the session; otherwise .
+ bool CanViewSession(ClaimsPrincipal? principal, string sessionId);
+}
diff --git a/src/ZB.MOM.WW.MxGateway.Tests/Alarms/AlarmTruncationSignalTests.cs b/src/ZB.MOM.WW.MxGateway.Tests/Alarms/AlarmTruncationSignalTests.cs
new file mode 100644
index 0000000..e8f8772
--- /dev/null
+++ b/src/ZB.MOM.WW.MxGateway.Tests/Alarms/AlarmTruncationSignalTests.cs
@@ -0,0 +1,329 @@
+using System.Diagnostics.CodeAnalysis;
+using System.Runtime.CompilerServices;
+using System.Threading.Channels;
+using Microsoft.Extensions.Logging.Abstractions;
+using ZB.MOM.WW.MxGateway.Contracts.Proto;
+using ZB.MOM.WW.MxGateway.Server.Alarms;
+using ZB.MOM.WW.MxGateway.Server.Configuration;
+using ZB.MOM.WW.MxGateway.Server.Grpc;
+using ZB.MOM.WW.MxGateway.Server.Metrics;
+using ZB.MOM.WW.MxGateway.Server.Security.Authorization;
+using ZB.MOM.WW.MxGateway.Server.Sessions;
+using ZB.MOM.WW.MxGateway.Tests.TestSupport;
+
+namespace ZB.MOM.WW.MxGateway.Tests.Alarms;
+
+///
+/// Carries the worker's truncated-fetch verdict across the gateway: worker
+/// reply payload → → the public
+/// QueryActiveAlarms stream.
+///
+///
+///
+/// The truncation guard itself (the worker merging rather than replacing
+/// a capped snapshot) is already covered in the worker suite. What was
+/// missing is that the guard is silent: a capped fetch suppresses
+/// absence-implies-Clear inference and says so only in a rate-limited
+/// stderr warning, so a consumer of the alarm surface could not tell a
+/// complete active set from a capped one. These tests pin the structural
+/// signal that replaces the guesswork.
+///
+///
+/// The load-bearing assertion is the false one
+/// ().
+/// "Truncated reply sets the flag" would also pass against a field
+/// hard-wired to true; only the complete-reply case proves the flag is
+/// actually derived from the worker's verdict.
+///
+///
+public sealed class AlarmTruncationSignalTests
+{
+ private static readonly TimeSpan WaitTimeout = TimeSpan.FromSeconds(15);
+
+ ///
+ /// A capped worker reply sets the monitor's completeness caveat and
+ /// stamps every cached snapshot, so both the dashboard (which reads the
+ /// service flag) and the RPC (which reads the records) can surface it.
+ ///
+ /// A task that represents the asynchronous operation.
+ [Fact]
+ public async Task Reconcile_WithTruncatedWorkerReply_SurfacesTheFlagOnMonitorAndSnapshots()
+ {
+ using GatewayMetrics metrics = new();
+ StubSessionManager sessions = new()
+ {
+ SnapshotTruncated = true,
+ Snapshots = [NewSnapshot("Galaxy!Area.Tank01.Level.HiHi", fromTruncatedSnapshot: true)],
+ };
+ using GatewayAlarmMonitor monitor = CreateMonitor(sessions, metrics);
+
+ using CancellationTokenSource cts = new();
+ await monitor.StartAsync(cts.Token);
+ await sessions.WaitForReconcileAsync(WaitTimeout);
+ await WaitUntilAsync(() => monitor.CurrentAlarms.Count == 1, WaitTimeout);
+
+ Assert.True(monitor.SnapshotTruncated);
+ ActiveAlarmSnapshot cached = Assert.Single(monitor.CurrentAlarms);
+ Assert.True(cached.FromTruncatedSnapshot);
+ // Truncation is about the completeness of the SET, not the fidelity of
+ // the record — the subtag-fallback flag must stay independent of it.
+ Assert.False(cached.Degraded);
+
+ await cts.CancelAsync();
+ await monitor.StopAsync(CancellationToken.None);
+ }
+
+ ///
+ /// The public QueryActiveAlarms stream carries the per-record flag
+ /// through untouched. That RPC returns a bare
+ /// stream ActiveAlarmSnapshot with no envelope message, so the
+ /// per-record boolean is the only place set-level degraded status can
+ /// ride — if the service ever starts re-projecting records instead of
+ /// forwarding them, this is what catches the dropped field.
+ ///
+ /// A task that represents the asynchronous operation.
+ [Fact]
+ public async Task QueryActiveAlarms_WithTruncatedSnapshot_StreamsTheFlagToTheClient()
+ {
+ FakeGatewayAlarmService alarms = new()
+ {
+ SnapshotTruncated = true,
+ CurrentAlarms = [NewSnapshot("Galaxy!Area.Tank01.Level.HiHi", fromTruncatedSnapshot: true)],
+ };
+ MxAccessGatewayService service = CreateService(alarms);
+ RecordingServerStreamWriter sink = new();
+
+ await service.QueryActiveAlarms(
+ new QueryActiveAlarmsRequest(),
+ sink,
+ new TestServerCallContext());
+
+ ActiveAlarmSnapshot streamed = Assert.Single(sink.Messages);
+ Assert.True(streamed.FromTruncatedSnapshot);
+ Assert.Equal("Galaxy!Area.Tank01.Level.HiHi", streamed.AlarmFullReference);
+ }
+
+ ///
+ /// The control. A complete worker reply must leave both the monitor flag
+ /// and the streamed records unset — otherwise every snapshot would read
+ /// as possibly-incomplete and the signal would carry no information.
+ ///
+ /// A task that represents the asynchronous operation.
+ [Fact]
+ public async Task QueryActiveAlarms_WithCompleteWorkerReply_LeavesFlagUnset()
+ {
+ using GatewayMetrics metrics = new();
+ StubSessionManager sessions = new()
+ {
+ SnapshotTruncated = false,
+ Snapshots = [NewSnapshot("Galaxy!Area.Tank01.Level.HiHi", fromTruncatedSnapshot: false)],
+ };
+ using GatewayAlarmMonitor monitor = CreateMonitor(sessions, metrics);
+
+ using CancellationTokenSource cts = new();
+ await monitor.StartAsync(cts.Token);
+ await sessions.WaitForReconcileAsync(WaitTimeout);
+ await WaitUntilAsync(() => monitor.CurrentAlarms.Count == 1, WaitTimeout);
+
+ Assert.False(monitor.SnapshotTruncated);
+
+ MxAccessGatewayService service = CreateService(new FakeGatewayAlarmService
+ {
+ SnapshotTruncated = monitor.SnapshotTruncated,
+ CurrentAlarms = monitor.CurrentAlarms,
+ });
+ RecordingServerStreamWriter sink = new();
+
+ await service.QueryActiveAlarms(
+ new QueryActiveAlarmsRequest(),
+ sink,
+ new TestServerCallContext());
+
+ Assert.False(Assert.Single(sink.Messages).FromTruncatedSnapshot);
+
+ await cts.CancelAsync();
+ await monitor.StopAsync(CancellationToken.None);
+ }
+
+ private static ActiveAlarmSnapshot NewSnapshot(string reference, bool fromTruncatedSnapshot)
+ {
+ return new ActiveAlarmSnapshot
+ {
+ AlarmFullReference = reference,
+ SourceObjectReference = "Tank01.Level",
+ AlarmTypeName = "HiHi",
+ Category = "Area",
+ Severity = 500,
+ CurrentState = AlarmConditionState.Active,
+ SourceProvider = AlarmProviderMode.Alarmmgr,
+ FromTruncatedSnapshot = fromTruncatedSnapshot,
+ };
+ }
+
+ private static GatewayAlarmMonitor CreateMonitor(StubSessionManager sessions, GatewayMetrics metrics)
+ {
+ AlarmsOptions options = new()
+ {
+ Enabled = true,
+ SubscriptionExpression = @"\\NODE\Galaxy!Area",
+ };
+ return new GatewayAlarmMonitor(
+ sessions,
+ new StubWatchListResolver(),
+ metrics,
+ Microsoft.Extensions.Options.Options.Create(new GatewayOptions { Alarms = options }),
+ NullLogger.Instance);
+ }
+
+ private static MxAccessGatewayService CreateService(FakeGatewayAlarmService alarms)
+ {
+ StubSessionManager sessions = new();
+ return new MxAccessGatewayService(
+ sessions,
+ new GatewayRequestIdentityAccessor(),
+ new AllowAllConstraintEnforcer(),
+ new MxAccessGrpcRequestValidator(),
+ new MxAccessGrpcMapper(),
+ new StubEventStreamService(),
+ new GatewayMetrics(),
+ NullLogger.Instance,
+ alarms);
+ }
+
+ private static async Task WaitUntilAsync(Func condition, TimeSpan timeout)
+ {
+ DateTime deadline = DateTime.UtcNow + timeout;
+ while (DateTime.UtcNow < deadline)
+ {
+ if (condition())
+ {
+ return;
+ }
+
+ await Task.Delay(25);
+ }
+
+ throw new TimeoutException("Condition was not met in time.");
+ }
+
+ /// that resolves an empty watch-list.
+ private sealed class StubWatchListResolver : IAlarmWatchListResolver
+ {
+ ///
+ public Task> ResolveAsync(
+ AlarmsOptions options,
+ CancellationToken cancellationToken = default) =>
+ Task.FromResult>([]);
+ }
+
+ ///
+ /// Minimal that answers the monitor's
+ /// QueryActiveAlarms with a scripted reply payload — the seam this suite
+ /// drives the truncation verdict through.
+ ///
+ private sealed class StubSessionManager : ISessionManager
+ {
+ private readonly Channel _events = Channel.CreateUnbounded();
+ private readonly TaskCompletionSource _reconciled =
+ new(TaskCreationOptions.RunContinuationsAsynchronously);
+
+ /// Gets or sets the truncation verdict the scripted reply carries.
+ public bool SnapshotTruncated { get; init; }
+
+ /// Gets or sets the snapshots the scripted reply carries.
+ public IReadOnlyList Snapshots { get; init; } = [];
+
+ /// Completes once the monitor has issued its first QueryActiveAlarms.
+ /// The maximum time to wait.
+ /// A task that represents the asynchronous operation.
+ public Task WaitForReconcileAsync(TimeSpan timeout) => _reconciled.Task.WaitAsync(timeout);
+
+ ///
+ public Task OpenSessionAsync(
+ SessionOpenRequest request,
+ string? clientIdentity,
+ string? ownerKeyId,
+ CancellationToken cancellationToken)
+ {
+ GatewaySession session = new(
+ Guid.NewGuid().ToString("N"),
+ "Galaxy",
+ "pipe-test",
+ "nonce-test",
+ clientIdentity,
+ null,
+ null,
+ TimeSpan.FromSeconds(30),
+ TimeSpan.FromSeconds(30),
+ TimeSpan.FromSeconds(30),
+ DateTimeOffset.UtcNow);
+ session.AttachWorkerClient(new ChannelWorkerClient(session.SessionId, _events.Reader));
+ session.MarkReady();
+ return Task.FromResult(session);
+ }
+
+ ///
+ public Task InvokeAsync(
+ string sessionId,
+ WorkerCommand command,
+ CancellationToken cancellationToken)
+ {
+ MxCommandReply reply = new()
+ {
+ ProtocolStatus = new ProtocolStatus { Code = ProtocolStatusCode.Ok },
+ };
+
+ if (command.Command?.Kind == MxCommandKind.QueryActiveAlarms)
+ {
+ QueryActiveAlarmsReplyPayload payload = new() { SnapshotTruncated = SnapshotTruncated };
+ payload.Snapshots.AddRange(Snapshots.Select(snapshot => snapshot.Clone()));
+ reply.QueryActiveAlarms = payload;
+ _reconciled.TrySetResult();
+ }
+
+ return Task.FromResult(new WorkerCommandReply { Reply = reply });
+ }
+
+ ///
+ public bool TryGetSession(string sessionId, [MaybeNullWhen(false)] out GatewaySession session)
+ {
+ session = null;
+ return false;
+ }
+
+ ///
+ public Task CloseSessionAsync(string sessionId, CancellationToken cancellationToken)
+ {
+ _events.Writer.TryComplete();
+ return Task.FromResult(new SessionCloseResult(sessionId, SessionState.Closed, AlreadyClosed: false));
+ }
+
+ ///
+ public Task KillWorkerAsync(string sessionId, string reason, CancellationToken cancellationToken) =>
+ Task.FromResult(new SessionCloseResult(sessionId, SessionState.Closed, AlreadyClosed: false));
+
+ ///
+ public Task CloseExpiredLeasesAsync(DateTimeOffset now, CancellationToken cancellationToken) =>
+ Task.FromResult(0);
+
+ ///
+ public Task ShutdownAsync(CancellationToken cancellationToken) => Task.CompletedTask;
+ }
+
+ ///
+ /// stub — QueryActiveAlarms never
+ /// touches the event path, but the service constructor requires one.
+ ///
+ private sealed class StubEventStreamService : IEventStreamService
+ {
+ ///
+ public async IAsyncEnumerable StreamEventsAsync(
+ StreamEventsRequest request,
+ string? callerKeyId,
+ [EnumeratorCancellation] CancellationToken cancellationToken)
+ {
+ await Task.CompletedTask.ConfigureAwait(false);
+ yield break;
+ }
+ }
+}
diff --git a/src/ZB.MOM.WW.MxGateway.Tests/Dashboard/AlarmsPageTruncationBannerTests.cs b/src/ZB.MOM.WW.MxGateway.Tests/Dashboard/AlarmsPageTruncationBannerTests.cs
new file mode 100644
index 0000000..ebb4e54
--- /dev/null
+++ b/src/ZB.MOM.WW.MxGateway.Tests/Dashboard/AlarmsPageTruncationBannerTests.cs
@@ -0,0 +1,105 @@
+using Microsoft.AspNetCore.Components.Web.HtmlRendering;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
+using ZB.MOM.WW.MxGateway.Server.Alarms;
+using ZB.MOM.WW.MxGateway.Server.Configuration;
+using ZB.MOM.WW.MxGateway.Server.Dashboard;
+using ZB.MOM.WW.MxGateway.Server.Dashboard.Components.Pages;
+using ZB.MOM.WW.MxGateway.Tests.TestSupport;
+using HtmlRenderer = Microsoft.AspNetCore.Components.Web.HtmlRenderer;
+
+namespace ZB.MOM.WW.MxGateway.Tests.Dashboard;
+
+///
+/// Renders and asserts the truncated-snapshot
+/// caveat banner appears exactly when the alarm query reports a capped
+/// provider fetch.
+///
+///
+///
+/// The absence assertion is the load-bearing one: a banner that renders
+/// unconditionally would satisfy the positive case while telling every
+/// operator, on every normal day, that the alarm list might be missing
+/// alarms. A caveat that is always on is a caveat nobody reads.
+///
+///
+/// Static rendering via the framework's , as in
+/// SecretsNavRenderTests — the assertion is about markup the server
+/// emits, so no component-testing dependency is warranted. The page's
+/// poll loop runs its first pass inline during OnInitialized
+/// (the stub query completes synchronously), so the rendered markup
+/// already reflects the query result.
+///
+///
+public sealed class AlarmsPageTruncationBannerTests
+{
+ private const string BannerMarker = "Alarm snapshot may be incomplete";
+
+ /// A capped provider fetch puts the completeness caveat on the page.
+ /// A task that represents the asynchronous operation.
+ [Fact]
+ public async Task AlarmsPage_WhenSnapshotTruncated_RendersTheCaveatBanner()
+ {
+ string html = await RenderAsync(snapshotTruncated: true);
+
+ Assert.Contains(BannerMarker, html, StringComparison.Ordinal);
+ }
+
+ ///
+ /// The proof the banner is gated. A complete fetch must render no caveat
+ /// at all, while the page itself still renders — the alarm-table heading
+ /// is the control that keeps this from passing over a blank page.
+ ///
+ /// A task that represents the asynchronous operation.
+ [Fact]
+ public async Task AlarmsPage_WhenSnapshotComplete_OmitsTheCaveatBanner()
+ {
+ string html = await RenderAsync(snapshotTruncated: false);
+
+ Assert.DoesNotContain(BannerMarker, html, StringComparison.Ordinal);
+ Assert.Contains("Active Alarms", html, StringComparison.Ordinal);
+ }
+
+ private static async Task RenderAsync(bool snapshotTruncated)
+ {
+ ServiceCollection services = new();
+ services.AddLogging();
+ services.AddSingleton(
+ new StubLiveDataService(snapshotTruncated));
+ services.AddSingleton(
+ new FakeGatewayAlarmService { SnapshotTruncated = snapshotTruncated });
+ services.AddSingleton>(
+ Options.Create(new GatewayOptions { Alarms = new AlarmsOptions { Enabled = true } }));
+
+ await using ServiceProvider provider = services.BuildServiceProvider();
+ await using HtmlRenderer renderer = new(
+ provider,
+ provider.GetRequiredService());
+
+ return await renderer.Dispatcher.InvokeAsync(async () =>
+ {
+ HtmlRootComponent output = await renderer.RenderComponentAsync();
+ return output.ToHtmlString();
+ });
+ }
+
+ // Answers the page's 3-second poll synchronously, so the first pass completes
+ // inline inside OnInitialized and the rendered markup reflects it.
+ private sealed class StubLiveDataService(bool snapshotTruncated) : IDashboardLiveDataService
+ {
+ ///
+ public Task ReadAsync(
+ IReadOnlyCollection tagAddresses,
+ CancellationToken cancellationToken) =>
+ Task.FromResult(DashboardLiveReadResult.Empty);
+
+ ///
+ public Task QueryAlarmsAsync(CancellationToken cancellationToken) =>
+ Task.FromResult(new DashboardAlarmQueryResult(
+ Alarms: [],
+ Error: null,
+ WorkerProcessId: null,
+ SnapshotTruncated: snapshotTruncated));
+ }
+}
diff --git a/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Dashboard/DashboardAuthenticatorTests.cs b/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Dashboard/DashboardAuthenticatorTests.cs
index 08e87b1..8773038 100644
--- a/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Dashboard/DashboardAuthenticatorTests.cs
+++ b/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Dashboard/DashboardAuthenticatorTests.cs
@@ -291,6 +291,7 @@ public sealed class DashboardAuthenticatorTests
return new DashboardAuthenticator(
ldapAuthService,
roleMapper,
+ Options.Create(options),
NullLogger.Instance);
}
diff --git a/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Dashboard/DashboardSessionAclTests.cs b/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Dashboard/DashboardSessionAclTests.cs
new file mode 100644
index 0000000..ff8ddba
--- /dev/null
+++ b/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Dashboard/DashboardSessionAclTests.cs
@@ -0,0 +1,264 @@
+using System.Diagnostics.CodeAnalysis;
+using System.Security.Claims;
+using Microsoft.Extensions.Options;
+using ZB.MOM.WW.MxGateway.Contracts.Proto;
+using ZB.MOM.WW.MxGateway.Server.Configuration;
+using ZB.MOM.WW.MxGateway.Server.Dashboard;
+using ZB.MOM.WW.MxGateway.Server.Sessions;
+
+namespace ZB.MOM.WW.MxGateway.Tests.Gateway.Dashboard;
+
+///
+/// Covers , the single decision both dashboard subscribe seams
+/// consult (SEC-25 / TST-15).
+///
+///
+/// Every branch is asserted in its denying direction as well as its allowing one, because the
+/// pre-ACL behaviour was "allow everything": an assertion that a permitted caller is permitted
+/// cannot distinguish a working gate from no gate at all.
+///
+public sealed class DashboardSessionAclTests
+{
+ private const string TaggedSessionId = "session-tagged";
+ private const string UntaggedSessionId = "session-untagged";
+
+ /// An Administrator bypasses the tag check entirely, including for a tag they hold none of.
+ [Fact]
+ public void CanViewSession_Administrator_BypassesTagCheck()
+ {
+ DashboardSessionAcl acl = CreateAcl();
+
+ Assert.True(acl.CanViewSession(Principal(roles: [DashboardRoles.Admin]), TaggedSessionId));
+ Assert.True(acl.CanViewSession(Principal(roles: [DashboardRoles.Admin]), UntaggedSessionId));
+ }
+
+ ///
+ /// The admin bypass is what keeps Dashboard:DisableLogin auto-login (which stamps both
+ /// roles and no tags) working exactly as before this change.
+ ///
+ [Fact]
+ public void CanViewSession_AutoLoginStyleBothRolesNoTags_Allowed()
+ {
+ DashboardSessionAcl acl = CreateAcl();
+
+ Assert.True(acl.CanViewSession(
+ Principal(roles: [DashboardRoles.Admin, DashboardRoles.Viewer]),
+ TaggedSessionId));
+ }
+
+ ///
+ /// An unknown session id is denied even for a caller holding every configured tag: no
+ /// subscription is created for a session the registry does not have.
+ ///
+ [Fact]
+ public void CanViewSession_UnknownSession_Denied()
+ {
+ DashboardSessionAcl acl = CreateAcl();
+
+ Assert.False(acl.CanViewSession(
+ Principal(roles: [DashboardRoles.Viewer], tags: ["team-a", "team-b"]),
+ "session-does-not-exist"));
+ }
+
+ /// A blank session id is denied without consulting anything.
+ [Theory]
+ [InlineData("")]
+ [InlineData(" ")]
+ public void CanViewSession_BlankSessionId_Denied(string sessionId)
+ {
+ DashboardSessionAcl acl = CreateAcl();
+
+ Assert.False(acl.CanViewSession(Principal(roles: [DashboardRoles.Admin]), sessionId));
+ }
+
+ /// A null principal denies — the fail-closed reading of an unauthenticated hub context.
+ [Fact]
+ public void CanViewSession_NullPrincipal_Denied()
+ {
+ DashboardSessionAcl acl = CreateAcl();
+
+ Assert.False(acl.CanViewSession(null, UntaggedSessionId));
+ }
+
+ ///
+ /// Untagged sessions follow Dashboard:UntaggedSessionVisibility: hidden from Viewers
+ /// under the shipped default, visible under
+ /// the opt-in .
+ ///
+ /// The configured untagged-session visibility.
+ /// Whether a tagless Viewer may observe the untagged session.
+ [Theory]
+ [InlineData(UntaggedSessionVisibility.AdminOnly, false)]
+ [InlineData(UntaggedSessionVisibility.AllViewers, true)]
+ public void CanViewSession_UntaggedSession_FollowsConfiguredVisibility(
+ UntaggedSessionVisibility visibility,
+ bool expected)
+ {
+ DashboardSessionAcl acl = CreateAcl(visibility);
+
+ Assert.Equal(
+ expected,
+ acl.CanViewSession(Principal(roles: [DashboardRoles.Viewer]), UntaggedSessionId));
+ }
+
+ ///
+ /// A Viewer whose grant intersects the session's tags is allowed; the comparison is
+ /// ordinal-ignore-case, matching the session's tag set and the config map.
+ ///
+ /// The single tag the Viewer holds.
+ [Theory]
+ [InlineData("team-a")]
+ [InlineData("TEAM-A")]
+ public void CanViewSession_ViewerGrantIntersectsSessionTags_Allowed(string grantedTag)
+ {
+ DashboardSessionAcl acl = CreateAcl();
+
+ Assert.True(acl.CanViewSession(
+ Principal(roles: [DashboardRoles.Viewer], tags: [grantedTag]),
+ TaggedSessionId));
+ }
+
+ /// A Viewer holding only another tenant's tag is denied — the load-bearing negative.
+ [Fact]
+ public void CanViewSession_ViewerGrantDisjointFromSessionTags_Denied()
+ {
+ DashboardSessionAcl acl = CreateAcl();
+
+ Assert.False(acl.CanViewSession(
+ Principal(roles: [DashboardRoles.Viewer], tags: ["team-b"]),
+ TaggedSessionId));
+ }
+
+ ///
+ /// A principal carrying no tag claims — the anonymous-localhost / empty-grant Viewer of
+ /// SEC-02 — sees a tagged session never, and an untagged one only when the operator opted
+ /// into .
+ ///
+ [Fact]
+ public void CanViewSession_NoTagClaims_IsEmptyGrantViewer()
+ {
+ ClaimsPrincipal anonymous = new(new ClaimsIdentity());
+
+ Assert.False(CreateAcl().CanViewSession(anonymous, TaggedSessionId));
+ Assert.False(CreateAcl(UntaggedSessionVisibility.AdminOnly).CanViewSession(anonymous, UntaggedSessionId));
+ Assert.True(CreateAcl(UntaggedSessionVisibility.AllViewers).CanViewSession(anonymous, UntaggedSessionId));
+ }
+
+ ///
+ /// An unauthenticated principal that nonetheless carries an Administrator role claim does not
+ /// get the bypass: the bypass requires a real authenticated identity, as elsewhere in the
+ /// dashboard (DashboardSessionAdminService.CanManage).
+ ///
+ [Fact]
+ public void CanViewSession_UnauthenticatedAdminRoleClaim_DoesNotBypass()
+ {
+ // No authentication type => IsAuthenticated is false.
+ ClaimsPrincipal principal = new(new ClaimsIdentity(
+ [new Claim(ClaimTypes.Role, DashboardRoles.Admin)],
+ authenticationType: null,
+ nameType: ClaimTypes.Name,
+ roleType: ClaimTypes.Role));
+
+ Assert.False(CreateAcl().CanViewSession(principal, TaggedSessionId));
+ }
+
+ private static DashboardSessionAcl CreateAcl(
+ UntaggedSessionVisibility visibility = UntaggedSessionVisibility.AdminOnly)
+ {
+ GatewayOptions options = new()
+ {
+ Dashboard = new DashboardOptions { UntaggedSessionVisibility = visibility },
+ };
+
+ return new DashboardSessionAcl(
+ new TwoSessionManager(
+ CreateSession(TaggedSessionId, ["team-a"]),
+ CreateSession(UntaggedSessionId, tags: null)),
+ Options.Create(options));
+ }
+
+ private static ClaimsPrincipal Principal(string[] roles, string[]? tags = null)
+ {
+ List claims = [new Claim(ClaimTypes.Name, "viewer-user")];
+ claims.AddRange(roles.Select(role => new Claim(ClaimTypes.Role, role)));
+ claims.AddRange((tags ?? []).Select(tag => new Claim(
+ DashboardAuthenticationDefaults.DashboardTagClaimType,
+ tag)));
+
+ return new ClaimsPrincipal(new ClaimsIdentity(
+ claims,
+ authenticationType: "test",
+ nameType: ClaimTypes.Name,
+ roleType: ClaimTypes.Role));
+ }
+
+ private static GatewaySession CreateSession(string sessionId, string[]? tags)
+ {
+ return new GatewaySession(
+ sessionId: sessionId,
+ backendName: "backend",
+ pipeName: $"pipe-{sessionId}",
+ nonce: "nonce",
+ clientIdentity: "client",
+ ownerKeyId: "key-1",
+ clientSessionName: "client-session",
+ clientCorrelationId: "correlation",
+ commandTimeout: TimeSpan.FromSeconds(5),
+ startupTimeout: TimeSpan.FromSeconds(5),
+ shutdownTimeout: TimeSpan.FromSeconds(5),
+ leaseDuration: TimeSpan.FromMinutes(30),
+ openedAt: DateTimeOffset.UnixEpoch,
+ ownerDashboardTags: tags);
+ }
+
+ /// Registry double serving exactly the two sessions the ACL cases need.
+ private sealed class TwoSessionManager(GatewaySession tagged, GatewaySession untagged) : ISessionManager
+ {
+ ///
+ public Task OpenSessionAsync(
+ SessionOpenRequest request,
+ string? clientIdentity,
+ string? ownerKeyId,
+ CancellationToken cancellationToken) => Task.FromResult(tagged);
+
+ ///
+ public bool TryGetSession(string sessionId, [MaybeNullWhen(false)] out GatewaySession session)
+ {
+ session = sessionId switch
+ {
+ TaggedSessionId => tagged,
+ UntaggedSessionId => untagged,
+ _ => null,
+ };
+
+ return session is not null;
+ }
+
+ ///
+ public Task InvokeAsync(
+ string sessionId,
+ WorkerCommand command,
+ CancellationToken cancellationToken) => Task.FromResult(new WorkerCommandReply());
+
+ ///
+ public Task CloseSessionAsync(
+ string sessionId,
+ CancellationToken cancellationToken) =>
+ Task.FromResult(new SessionCloseResult(sessionId, SessionState.Closed, AlreadyClosed: false));
+
+ ///
+ public Task KillWorkerAsync(
+ string sessionId,
+ string reason,
+ CancellationToken cancellationToken) =>
+ Task.FromResult(new SessionCloseResult(sessionId, SessionState.Closed, AlreadyClosed: false));
+
+ ///
+ public Task CloseExpiredLeasesAsync(
+ DateTimeOffset now,
+ CancellationToken cancellationToken) => Task.FromResult(0);
+
+ ///
+ public Task ShutdownAsync(CancellationToken cancellationToken) => Task.CompletedTask;
+ }
+}
diff --git a/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Dashboard/EventsHubTests.cs b/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Dashboard/EventsHubTests.cs
new file mode 100644
index 0000000..b0f2b83
--- /dev/null
+++ b/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Dashboard/EventsHubTests.cs
@@ -0,0 +1,175 @@
+using System.Security.Claims;
+using Microsoft.AspNetCore.Http.Features;
+using Microsoft.AspNetCore.SignalR;
+using ZB.MOM.WW.MxGateway.Server.Dashboard;
+using ZB.MOM.WW.MxGateway.Server.Dashboard.Hubs;
+
+namespace ZB.MOM.WW.MxGateway.Tests.Gateway.Dashboard;
+
+///
+/// Covers the ACL gate on (SEC-25 / TST-15).
+///
+///
+/// The denial assertions are the load-bearing ones — before the gate existed every caller was
+/// joined, so "an allowed caller is joined" is indistinguishable from no gate. They assert the
+/// absence of BOTH effects of a join: the SignalR group membership and the viewer registration
+/// that turns the broadcaster's mirror on for the session. Leaving either behind would keep the
+/// event clone running for a caller who may not observe it.
+///
+public sealed class EventsHubTests
+{
+ private const string SessionId = "session-1";
+ private const string ConnectionId = "connection-1";
+
+ private static readonly ClaimsPrincipal TestPrincipal = new(new ClaimsIdentity(
+ [new Claim(ClaimTypes.Name, "viewer-user")],
+ authenticationType: "test"));
+
+ /// An allowed caller joins the group and registers as a viewer.
+ /// A task that represents the asynchronous operation.
+ [Fact]
+ public async Task SubscribeSession_WhenAclAllows_JoinsGroupAndRegistersViewer()
+ {
+ EventsHubViewerRegistry registry = new();
+ RecordingGroupManager groups = new();
+ EventsHub hub = CreateHub(registry, groups, allow: true);
+
+ await hub.SubscribeSession(SessionId);
+
+ Assert.Equal([(ConnectionId, EventsHub.GroupName(SessionId))], groups.Added);
+ Assert.True(registry.HasViewers(SessionId));
+ }
+
+ ///
+ /// A denied caller gets a , is not joined, and is not registered.
+ ///
+ /// A task that represents the asynchronous operation.
+ [Fact]
+ public async Task SubscribeSession_WhenAclDenies_ThrowsAndDoesNotJoin()
+ {
+ EventsHubViewerRegistry registry = new();
+ RecordingGroupManager groups = new();
+ EventsHub hub = CreateHub(registry, groups, allow: false);
+
+ HubException error = await Assert.ThrowsAsync(() => hub.SubscribeSession(SessionId));
+
+ Assert.Equal("Not authorized for this session.", error.Message);
+ Assert.Empty(groups.Added);
+ Assert.False(registry.HasViewers(SessionId));
+ }
+
+ ///
+ /// A blank session id is still a no-op rather than a denial, so a client that sends one is not
+ /// told it lacks authorization for a session it never named.
+ ///
+ /// The blank session id supplied by the caller.
+ /// A task that represents the asynchronous operation.
+ [Theory]
+ [InlineData("")]
+ [InlineData(" ")]
+ public async Task SubscribeSession_BlankSessionId_IsNoOp(string sessionId)
+ {
+ EventsHubViewerRegistry registry = new();
+ RecordingGroupManager groups = new();
+ EventsHub hub = CreateHub(registry, groups, allow: false);
+
+ await hub.SubscribeSession(sessionId);
+
+ Assert.Empty(groups.Added);
+ }
+
+ /// The ACL is asked about the session the caller named, with the caller's own principal.
+ /// A task that represents the asynchronous operation.
+ [Fact]
+ public async Task SubscribeSession_AsksAclAboutTheRequestedSession()
+ {
+ StubSessionAcl acl = new(allow: true);
+ EventsHub hub = new(new EventsHubViewerRegistry(), acl)
+ {
+ Groups = new RecordingGroupManager(),
+ Context = new StubHubCallerContext(ConnectionId, TestPrincipal),
+ };
+
+ await hub.SubscribeSession(SessionId);
+
+ Assert.Equal(SessionId, acl.LastSessionId);
+ Assert.Same(TestPrincipal, acl.LastPrincipal);
+ }
+
+ private static EventsHub CreateHub(
+ EventsHubViewerRegistry registry,
+ RecordingGroupManager groups,
+ bool allow)
+ {
+ return new EventsHub(registry, new StubSessionAcl(allow))
+ {
+ Groups = groups,
+ Context = new StubHubCallerContext(ConnectionId, TestPrincipal),
+ };
+ }
+
+ private sealed class StubSessionAcl(bool allow) : IDashboardSessionAcl
+ {
+ /// Gets the principal passed to the most recent call.
+ public ClaimsPrincipal? LastPrincipal { get; private set; }
+
+ /// Gets the session id passed to the most recent call.
+ public string? LastSessionId { get; private set; }
+
+ ///
+ public bool CanViewSession(ClaimsPrincipal? principal, string sessionId)
+ {
+ LastPrincipal = principal;
+ LastSessionId = sessionId;
+
+ return allow;
+ }
+ }
+
+ private sealed class RecordingGroupManager : IGroupManager
+ {
+ /// Gets the (connection id, group name) pairs added, in order.
+ public List<(string ConnectionId, string GroupName)> Added { get; } = [];
+
+ ///
+ public Task AddToGroupAsync(string connectionId, string groupName, CancellationToken cancellationToken = default)
+ {
+ Added.Add((connectionId, groupName));
+
+ return Task.CompletedTask;
+ }
+
+ ///
+ public Task RemoveFromGroupAsync(
+ string connectionId,
+ string groupName,
+ CancellationToken cancellationToken = default) => Task.CompletedTask;
+ }
+
+ private sealed class StubHubCallerContext(string connectionId, ClaimsPrincipal user) : HubCallerContext
+ {
+ ///
+ public override string ConnectionId { get; } = connectionId;
+
+ ///
+ public override string? UserIdentifier => User?.Identity?.Name;
+
+ ///
+ public override ClaimsPrincipal? User { get; } = user;
+
+ ///
+ public override IDictionary Items { get; } = new Dictionary();
+
+ ///
+ public override IFeatureCollection Features { get; } = new FeatureCollection();
+
+ ///
+ public override CancellationToken ConnectionAborted => CancellationToken.None;
+
+ ///
+ public override void Abort()
+ {
+ // Nothing to abort in a unit-constructed context.
+ }
+ }
+}
diff --git a/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Dashboard/HubTokenServiceTests.cs b/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Dashboard/HubTokenServiceTests.cs
index 502cd9d..43a390c 100644
--- a/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Dashboard/HubTokenServiceTests.cs
+++ b/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Dashboard/HubTokenServiceTests.cs
@@ -1,5 +1,7 @@
using System.Security.Claims;
using Microsoft.AspNetCore.DataProtection;
+using Microsoft.Extensions.Options;
+using ZB.MOM.WW.MxGateway.Server.Configuration;
using ZB.MOM.WW.MxGateway.Server.Dashboard;
namespace ZB.MOM.WW.MxGateway.Tests.Gateway.Dashboard;
@@ -19,7 +21,7 @@ public sealed class HubTokenServiceTests
[Fact]
public void Validate_TokenWithNullNameAndNullNameIdentifier_ReturnsNull()
{
- HubTokenService service = new(new EphemeralDataProtectionProvider());
+ HubTokenService service = CreateService();
// Issue from a principal with NO Name claim and NO NameIdentifier
// claim. The Issue method's payload will then carry
@@ -43,7 +45,7 @@ public sealed class HubTokenServiceTests
[Fact]
public void Validate_TokenWithName_ReturnsAuthenticatedPrincipal()
{
- HubTokenService service = new(new EphemeralDataProtectionProvider());
+ HubTokenService service = CreateService();
ClaimsIdentity identity = new(
[
@@ -72,7 +74,7 @@ public sealed class HubTokenServiceTests
[Fact]
public void Validate_TokenWithOnlyNameIdentifier_ReturnsPrincipal()
{
- HubTokenService service = new(new EphemeralDataProtectionProvider());
+ HubTokenService service = CreateService();
ClaimsIdentity identity = new(
[
@@ -93,7 +95,7 @@ public sealed class HubTokenServiceTests
[Fact]
public void Validate_NullToken_ReturnsNull()
{
- HubTokenService service = new(new EphemeralDataProtectionProvider());
+ HubTokenService service = CreateService();
Assert.Null(service.Validate(null));
}
@@ -102,7 +104,7 @@ public sealed class HubTokenServiceTests
[Fact]
public void Validate_EmptyToken_ReturnsNull()
{
- HubTokenService service = new(new EphemeralDataProtectionProvider());
+ HubTokenService service = CreateService();
Assert.Null(service.Validate(string.Empty));
}
@@ -111,7 +113,7 @@ public sealed class HubTokenServiceTests
[Fact]
public void Validate_GarbageToken_ReturnsNull()
{
- HubTokenService service = new(new EphemeralDataProtectionProvider());
+ HubTokenService service = CreateService();
Assert.Null(service.Validate("this-is-not-a-protected-payload"));
}
@@ -123,7 +125,7 @@ public sealed class HubTokenServiceTests
[Fact]
public void IssueThenValidate_FreshToken_RoundTripsIdentityAndRoles()
{
- HubTokenService service = new(new EphemeralDataProtectionProvider());
+ HubTokenService service = CreateService();
ClaimsIdentity identity = new(
[
new Claim(ClaimTypes.Name, "bob"),
@@ -163,7 +165,7 @@ public sealed class HubTokenServiceTests
[Fact]
public void Validate_ExpiredToken_ReturnsNull()
{
- HubTokenService service = new(new EphemeralDataProtectionProvider());
+ HubTokenService service = CreateService();
ClaimsIdentity identity = new(
[new Claim(ClaimTypes.Name, "carol")],
authenticationType: "test");
@@ -174,4 +176,85 @@ public sealed class HubTokenServiceTests
Assert.Null(service.Validate(expiredToken));
}
+
+ ///
+ /// The dashboard visibility grant (SEC-25) survives the mint/validate round-trip: tags are
+ /// resolved from the caller's LDAP-group claims through Dashboard:GroupToTag at
+ /// and rehydrated as
+ /// claims on the principal
+ /// reconstructs — which is the principal
+ /// IDashboardSessionAcl reads on the hub path.
+ ///
+ [Fact]
+ public void IssueThenValidate_ResolvesAndRoundTripsGrantedTags()
+ {
+ HubTokenService service = CreateService(new Dictionary(StringComparer.OrdinalIgnoreCase)
+ {
+ ["GwViewer"] = ["team-a"],
+ ["TeamBViewers"] = ["team-b"],
+ });
+
+ ClaimsIdentity identity = new(
+ [
+ new Claim(ClaimTypes.Name, "dana"),
+ new Claim(ClaimTypes.Role, DashboardRoles.Viewer),
+ new Claim(DashboardAuthenticationDefaults.LdapGroupClaimType, "GwViewer"),
+ new Claim(DashboardAuthenticationDefaults.LdapGroupClaimType, "TeamBViewers"),
+ ],
+ authenticationType: "test",
+ nameType: ClaimTypes.Name,
+ roleType: ClaimTypes.Role);
+
+ ClaimsPrincipal? result = service.Validate(service.Issue(new ClaimsPrincipal(identity)));
+
+ Assert.NotNull(result);
+ Assert.Equal(
+ ["team-a", "team-b"],
+ result.FindAll(DashboardAuthenticationDefaults.DashboardTagClaimType)
+ .Select(c => c.Value)
+ .Order(StringComparer.Ordinal));
+ }
+
+ ///
+ /// A caller whose groups map to nothing mints a token with no tags, and validating it yields a
+ /// principal carrying no tag claims — the empty grant the ACL denies tagged sessions on. This
+ /// is also the shape of every token minted before the tag field existed (the payload field
+ /// deserializes to null), so the fail-closed direction is covered for both.
+ ///
+ [Fact]
+ public void IssueThenValidate_WithNoMatchingGroups_ProducesEmptyGrant()
+ {
+ HubTokenService service = CreateService(new Dictionary(StringComparer.OrdinalIgnoreCase)
+ {
+ ["SomeOtherGroup"] = ["team-a"],
+ });
+
+ ClaimsIdentity identity = new(
+ [
+ new Claim(ClaimTypes.Name, "erin"),
+ new Claim(ClaimTypes.Role, DashboardRoles.Viewer),
+ new Claim(DashboardAuthenticationDefaults.LdapGroupClaimType, "GwViewer"),
+ ],
+ authenticationType: "test",
+ nameType: ClaimTypes.Name,
+ roleType: ClaimTypes.Role);
+
+ ClaimsPrincipal? result = service.Validate(service.Issue(new ClaimsPrincipal(identity)));
+
+ Assert.NotNull(result);
+ Assert.Empty(result.FindAll(DashboardAuthenticationDefaults.DashboardTagClaimType));
+ }
+
+ private static HubTokenService CreateService(Dictionary? groupToTag = null)
+ {
+ GatewayOptions options = new()
+ {
+ Dashboard = new DashboardOptions
+ {
+ GroupToTag = groupToTag ?? new Dictionary(StringComparer.OrdinalIgnoreCase),
+ },
+ };
+
+ return new HubTokenService(new EphemeralDataProtectionProvider(), Options.Create(options));
+ }
}
diff --git a/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Dashboard/SessionDetailsPageEventAclTests.cs b/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Dashboard/SessionDetailsPageEventAclTests.cs
new file mode 100644
index 0000000..7b500ef
--- /dev/null
+++ b/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Dashboard/SessionDetailsPageEventAclTests.cs
@@ -0,0 +1,218 @@
+using System.Runtime.CompilerServices;
+using System.Security.Claims;
+using System.Threading.Channels;
+using Microsoft.AspNetCore.Components;
+using Microsoft.AspNetCore.Components.Authorization;
+using Microsoft.AspNetCore.Components.Web;
+using Microsoft.AspNetCore.Components.Web.HtmlRendering;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using ZB.MOM.WW.MxGateway.Contracts.Proto;
+using ZB.MOM.WW.MxGateway.Server.Dashboard;
+using ZB.MOM.WW.MxGateway.Server.Dashboard.Components.Pages;
+using ZB.MOM.WW.MxGateway.Server.Dashboard.Hubs;
+
+namespace ZB.MOM.WW.MxGateway.Tests.Gateway.Dashboard;
+
+///
+/// Covers the ACL gate on the session-details page's in-process subscribe seam (SEC-25 / TST-15).
+///
+///
+///
+/// The 2026-08 in-process feed refactor gave the dashboard a second way to subscribe to a
+/// session's events — , used by this page — so
+/// gating the hub join alone would leave the page as an ungated path to the same feed. The
+/// denial assertion here is the one that proves the second seam is closed: it asserts that
+/// is never called, not merely that the
+/// panel renders differently.
+///
+///
+/// Rendered through the framework's static , the same idiom
+/// SecretsNavRenderTests uses — no component-testing package, because the assertions are
+/// about the emitted markup and the calls the lifecycle makes, not about interactivity.
+///
+///
+public sealed class SessionDetailsPageEventAclTests
+{
+ private const string SessionId = "session-1";
+ // Matched without the trailing possessive so the assertion does not depend on how the
+ // renderer escapes the apostrophe.
+ private const string DeniedMessage = "Not authorized for this session";
+ private const string WaitingMarker = "Waiting for events.";
+
+ /// A denied caller gets the message and no subscription is opened.
+ /// A task that represents the asynchronous operation.
+ [Fact]
+ public async Task Page_WhenAclDenies_RendersMessageAndDoesNotSubscribe()
+ {
+ RecordingEventSubscriber subscriber = new();
+
+ string html = await RenderAsync(subscriber, allow: false);
+
+ Assert.Contains(DeniedMessage, html, StringComparison.Ordinal);
+ Assert.DoesNotContain(WaitingMarker, html, StringComparison.Ordinal);
+ Assert.Empty(subscriber.SubscribedSessionIds);
+ }
+
+ ///
+ /// The control for the denial above: an allowed caller subscribes and sees the ordinary
+ /// waiting state. Without this, a page that failed to render its events panel at all would
+ /// satisfy the "no subscription" assertion and the suite would report a working gate over a
+ /// broken panel.
+ ///
+ /// A task that represents the asynchronous operation.
+ [Fact]
+ public async Task Page_WhenAclAllows_SubscribesAndRendersWaitingState()
+ {
+ RecordingEventSubscriber subscriber = new();
+
+ string html = await RenderAsync(subscriber, allow: true);
+
+ Assert.Equal([SessionId], subscriber.SubscribedSessionIds);
+ Assert.Contains(WaitingMarker, html, StringComparison.Ordinal);
+ Assert.DoesNotContain(DeniedMessage, html, StringComparison.Ordinal);
+ }
+
+ private static async Task RenderAsync(RecordingEventSubscriber subscriber, bool allow)
+ {
+ ServiceCollection services = new();
+ services.AddLogging();
+ services.AddSingleton(new StubSnapshotService());
+ services.AddSingleton(new IdleSnapshotFeed());
+ services.AddSingleton(new NonManagingSessionAdminService());
+ services.AddSingleton(subscriber);
+ services.AddSingleton(new StubSessionAcl(allow));
+ services.AddSingleton(new StubAuthenticationStateProvider());
+
+ await using ServiceProvider provider = services.BuildServiceProvider();
+ await using HtmlRenderer renderer = new(provider, provider.GetRequiredService());
+
+ return await renderer.Dispatcher.InvokeAsync(async () =>
+ {
+ HtmlRootComponent output = await renderer.RenderComponentAsync(
+ ParameterView.FromDictionary(new Dictionary
+ {
+ [nameof(SessionDetailsPage.SessionId)] = SessionId,
+ }));
+
+ return output.ToHtmlString();
+ });
+ }
+
+ private sealed class StubSessionAcl(bool allow) : IDashboardSessionAcl
+ {
+ ///
+ public bool CanViewSession(ClaimsPrincipal? principal, string sessionId) => allow;
+ }
+
+ private sealed class RecordingEventSubscriber : IDashboardSessionEventSubscriber
+ {
+ /// Gets the session ids was called with, in order.
+ public List SubscribedSessionIds { get; } = [];
+
+ ///
+ public IDashboardEventSubscription Subscribe(string sessionId)
+ {
+ SubscribedSessionIds.Add(sessionId);
+
+ return new IdleSubscription();
+ }
+
+ // A subscription whose channel never yields and never completes, so the page's pump parks
+ // exactly as it would against a quiet session.
+ private sealed class IdleSubscription : IDashboardEventSubscription
+ {
+ private readonly Channel _channel = Channel.CreateUnbounded();
+
+ ///
+ public ChannelReader Reader => _channel.Reader;
+
+ ///
+ public void Dispose() => _channel.Writer.TryComplete();
+ }
+ }
+
+ private sealed class StubSnapshotService : IDashboardSnapshotService
+ {
+ ///
+ public DashboardSnapshot GetSnapshot() => new(
+ GeneratedAt: DateTimeOffset.UnixEpoch,
+ GatewayStartedAt: DateTimeOffset.UnixEpoch,
+ GatewayUptime: TimeSpan.Zero,
+ GatewayStatus: "Healthy",
+ GatewayVersion: "test",
+ Sessions:
+ [
+ new DashboardSessionSummary(
+ SessionId: SessionId,
+ BackendName: "backend",
+ State: SessionState.Ready,
+ ClientIdentity: "client",
+ ClientSessionName: "client-session",
+ ClientCorrelationId: "correlation",
+ OpenedAt: DateTimeOffset.UnixEpoch,
+ LastClientActivityAt: DateTimeOffset.UnixEpoch,
+ LeaseExpiresAt: null,
+ WorkerProcessId: null,
+ WorkerState: null,
+ LastWorkerHeartbeatAt: null,
+ EventsReceived: 0,
+ LastFault: null),
+ ],
+ Workers: [],
+ Metrics: [],
+ Faults: [],
+ ApiKeys: [],
+ Configuration: null!,
+ Galaxy: null!);
+
+ ///
+ public IAsyncEnumerable WatchSnapshotsAsync(CancellationToken cancellationToken) =>
+ new IdleSnapshotFeed().WatchAsync(cancellationToken);
+ }
+
+ // Parks until the page is disposed, so the base page's watch loop neither spins nor pushes a
+ // second snapshot mid-assertion.
+ private sealed class IdleSnapshotFeed : IDashboardSnapshotFeed
+ {
+ ///
+ public async IAsyncEnumerable WatchAsync(
+ [EnumeratorCancellation] CancellationToken cancellationToken)
+ {
+ await Task.Delay(Timeout.Infinite, cancellationToken).ConfigureAwait(false);
+
+ yield break;
+ }
+ }
+
+ private sealed class NonManagingSessionAdminService : IDashboardSessionAdminService
+ {
+ ///
+ public bool CanManage(ClaimsPrincipal user) => false;
+
+ ///
+ public Task CloseSessionAsync(
+ ClaimsPrincipal user,
+ string sessionId,
+ CancellationToken cancellationToken) =>
+ Task.FromResult(DashboardSessionAdminResult.Fail("not supported"));
+
+ ///
+ public Task KillWorkerAsync(
+ ClaimsPrincipal user,
+ string sessionId,
+ CancellationToken cancellationToken) =>
+ Task.FromResult(DashboardSessionAdminResult.Fail("not supported"));
+ }
+
+ private sealed class StubAuthenticationStateProvider : AuthenticationStateProvider
+ {
+ ///
+ public override Task GetAuthenticationStateAsync() =>
+ Task.FromResult(new AuthenticationState(new ClaimsPrincipal(new ClaimsIdentity(
+ [new Claim(ClaimTypes.Name, "viewer-user"), new Claim(ClaimTypes.Role, DashboardRoles.Viewer)],
+ authenticationType: "test",
+ nameType: ClaimTypes.Name,
+ roleType: ClaimTypes.Role))));
+ }
+}
diff --git a/src/ZB.MOM.WW.MxGateway.Tests/TestSupport/FakeGatewayAlarmService.cs b/src/ZB.MOM.WW.MxGateway.Tests/TestSupport/FakeGatewayAlarmService.cs
index e0e1674..369b672 100644
--- a/src/ZB.MOM.WW.MxGateway.Tests/TestSupport/FakeGatewayAlarmService.cs
+++ b/src/ZB.MOM.WW.MxGateway.Tests/TestSupport/FakeGatewayAlarmService.cs
@@ -24,6 +24,9 @@ public sealed class FakeGatewayAlarmService : IGatewayAlarmService
///
public IReadOnlyList CurrentAlarms { get; set; } = [];
+ ///
+ public bool SnapshotTruncated { get; set; }
+
///
public async IAsyncEnumerable StreamAsync(
string? alarmFilterPrefix,
diff --git a/src/ZB.MOM.WW.MxGateway.Worker.Tests/MxAccess/AlarmCommandExecutorTests.cs b/src/ZB.MOM.WW.MxGateway.Worker.Tests/MxAccess/AlarmCommandExecutorTests.cs
index bef898a..a2df0ef 100644
--- a/src/ZB.MOM.WW.MxGateway.Worker.Tests/MxAccess/AlarmCommandExecutorTests.cs
+++ b/src/ZB.MOM.WW.MxGateway.Worker.Tests/MxAccess/AlarmCommandExecutorTests.cs
@@ -371,6 +371,9 @@ public sealed class AlarmCommandExecutorTests
/// Gets the last alarm filter prefix.
public string? LastFilterPrefix { get; private set; }
+ /// Gets or sets the truncation verdict the executor stamps onto the reply payload.
+ public bool LastSnapshotTruncated { get; set; }
+
///
public void Subscribe(SubscribeAlarmsCommand command, string sessionId)
{
diff --git a/src/ZB.MOM.WW.MxGateway.Worker.Tests/MxAccess/AlarmCommandHandlerTests.cs b/src/ZB.MOM.WW.MxGateway.Worker.Tests/MxAccess/AlarmCommandHandlerTests.cs
index 5e95c0e..d44a07e 100644
--- a/src/ZB.MOM.WW.MxGateway.Worker.Tests/MxAccess/AlarmCommandHandlerTests.cs
+++ b/src/ZB.MOM.WW.MxGateway.Worker.Tests/MxAccess/AlarmCommandHandlerTests.cs
@@ -473,6 +473,9 @@ public sealed class AlarmCommandHandlerTests
///
public IReadOnlyList SnapshotActiveAlarms() => SnapshotResult;
+ /// Gets or sets the truncation verdict reported for the last fetch.
+ public bool LastSnapshotTruncated { get; set; }
+
/// Gets the number of times polled.
public int PollCount { get; private set; }
diff --git a/src/ZB.MOM.WW.MxGateway.Worker.Tests/MxAccess/AlarmDispatcherTests.cs b/src/ZB.MOM.WW.MxGateway.Worker.Tests/MxAccess/AlarmDispatcherTests.cs
index 4106c79..7b0474a 100644
--- a/src/ZB.MOM.WW.MxGateway.Worker.Tests/MxAccess/AlarmDispatcherTests.cs
+++ b/src/ZB.MOM.WW.MxGateway.Worker.Tests/MxAccess/AlarmDispatcherTests.cs
@@ -438,6 +438,9 @@ public sealed class AlarmDispatcherTests
return SnapshotResult;
}
+ /// Gets or sets the truncation verdict the dispatcher stamps onto snapshots.
+ public bool LastSnapshotTruncated { get; set; }
+
/// Gets the count of poll operations.
public int PollCount { get; private set; }
diff --git a/src/ZB.MOM.WW.MxGateway.Worker.Tests/MxAccess/FailoverAlarmConsumerTests.cs b/src/ZB.MOM.WW.MxGateway.Worker.Tests/MxAccess/FailoverAlarmConsumerTests.cs
index 71f5f8d..3625ab9 100644
--- a/src/ZB.MOM.WW.MxGateway.Worker.Tests/MxAccess/FailoverAlarmConsumerTests.cs
+++ b/src/ZB.MOM.WW.MxGateway.Worker.Tests/MxAccess/FailoverAlarmConsumerTests.cs
@@ -80,6 +80,9 @@ public sealed class FailoverAlarmConsumerTests
///
public IReadOnlyList SnapshotActiveAlarms() => Array.Empty();
+ /// Gets or sets the truncation verdict this child reports, so delegation is observable.
+ public bool LastSnapshotTruncated { get; set; }
+
///
public void Dispose() { }
@@ -132,6 +135,9 @@ public sealed class FailoverAlarmConsumerTests
return Array.Empty();
}
+ /// Gets or sets the truncation verdict this child reports, so delegation is observable.
+ public bool LastSnapshotTruncated { get; set; }
+
///
public void Dispose() { }
diff --git a/src/ZB.MOM.WW.MxGateway.Worker.Tests/MxAccess/MxAccessStaSessionTests.cs b/src/ZB.MOM.WW.MxGateway.Worker.Tests/MxAccess/MxAccessStaSessionTests.cs
index aace1d7..0e7fd07 100644
--- a/src/ZB.MOM.WW.MxGateway.Worker.Tests/MxAccess/MxAccessStaSessionTests.cs
+++ b/src/ZB.MOM.WW.MxGateway.Worker.Tests/MxAccess/MxAccessStaSessionTests.cs
@@ -643,6 +643,9 @@ public sealed class MxAccessStaSessionTests
get { lock (gate) return lastPollThreadId; }
}
+ /// Gets or sets the truncation verdict reported for the last fetch.
+ public bool LastSnapshotTruncated { get; set; }
+
///
public void Subscribe(SubscribeAlarmsCommand command, string sessionId)
{
diff --git a/src/ZB.MOM.WW.MxGateway.Worker.Tests/MxAccess/WnWrapAlarmConsumerXmlTests.cs b/src/ZB.MOM.WW.MxGateway.Worker.Tests/MxAccess/WnWrapAlarmConsumerXmlTests.cs
index 7dd9448..28c4293 100644
--- a/src/ZB.MOM.WW.MxGateway.Worker.Tests/MxAccess/WnWrapAlarmConsumerXmlTests.cs
+++ b/src/ZB.MOM.WW.MxGateway.Worker.Tests/MxAccess/WnWrapAlarmConsumerXmlTests.cs
@@ -688,6 +688,88 @@ public sealed class WnWrapAlarmConsumerXmlTests
Assert.Equal(MxAlarmStateKind.UnackAlm, record.State);
}
+ // -------------------------------------------------------------------------
+ // Degraded-status signal. The truncation guard above keeps a capped fetch
+ // from broadcasting phantom Clears, but it does so silently: the retained
+ // snapshot simply stops shrinking. LastSnapshotTruncated is what makes that
+ // suppression visible to the QueryActiveAlarms reply and, through it, the
+ // dashboard banner — so its set/reset behaviour is the contract, not detail.
+ // -------------------------------------------------------------------------
+
+ ///
+ /// A capped fetch sets the retained truncation verdict. Without this the
+ /// signal never leaves the consumer and the reply builder stamps a
+ /// complete-looking snapshot over a capped one.
+ ///
+ [Fact]
+ public void FoldFetch_WhenFetchTruncated_SetsLastSnapshotTruncated()
+ {
+ const int Cap = 8;
+ using WnWrapAlarmConsumer consumer = new WnWrapAlarmConsumer(Cap);
+
+ Assert.False(consumer.LastSnapshotTruncated);
+
+ Dictionary next =
+ WnWrapAlarmConsumer.ParseSnapshotXml(BuildAlarmXml(Cap), out int fetchedRecordCount);
+ Assert.True(WnWrapAlarmConsumer.IsTruncatedFetch(fetchedRecordCount, Cap));
+
+ consumer.FoldFetch(next, truncated: true, out int retainedCount);
+
+ Assert.True(consumer.LastSnapshotTruncated);
+ Assert.Equal(Cap, retainedCount);
+ }
+
+ ///
+ /// THE reset test. A sub-cap fetch is complete, so it restores absence
+ /// authority and must clear the verdict. Latching it instead would leave
+ /// the operator banner asserting "snapshot may be incomplete" forever
+ /// after a single burst above the cap, which trains operators to ignore
+ /// it — the opposite of what the signal is for.
+ ///
+ [Fact]
+ public void FoldFetch_AfterTruncatedFetch_SubCapFetchClearsLastSnapshotTruncated()
+ {
+ const int Cap = 8;
+ using WnWrapAlarmConsumer consumer = new WnWrapAlarmConsumer(Cap);
+
+ Dictionary capped =
+ WnWrapAlarmConsumer.ParseSnapshotXml(BuildAlarmXml(Cap), out _);
+ consumer.FoldFetch(capped, truncated: true, out _);
+ Assert.True(consumer.LastSnapshotTruncated);
+
+ Dictionary complete =
+ WnWrapAlarmConsumer.ParseSnapshotXml(BuildAlarmXml(Cap - 1), out int fetchedRecordCount);
+ Assert.False(WnWrapAlarmConsumer.IsTruncatedFetch(fetchedRecordCount, Cap));
+
+ consumer.FoldFetch(complete, truncated: false, out int retainedCount);
+
+ Assert.False(consumer.LastSnapshotTruncated);
+ // The complete fetch also replaced the snapshot wholesale, which is what
+ // makes it authoritative about absence — pinned here so a future change
+ // cannot clear the verdict while keeping the merge semantics.
+ Assert.Equal(Cap - 1, retainedCount);
+ }
+
+ ///
+ /// Consecutive capped fetches keep the verdict set. It is per-fetch state,
+ /// not an edge-triggered one-shot: an operator arriving mid-burst must
+ /// still see the caveat.
+ ///
+ [Fact]
+ public void FoldFetch_WithConsecutiveTruncatedFetches_KeepsLastSnapshotTruncatedSet()
+ {
+ const int Cap = 8;
+ using WnWrapAlarmConsumer consumer = new WnWrapAlarmConsumer(Cap);
+
+ for (int pass = 0; pass < 3; pass++)
+ {
+ Dictionary capped =
+ WnWrapAlarmConsumer.ParseSnapshotXml(BuildAlarmXml(Cap), out _);
+ consumer.FoldFetch(capped, truncated: true, out _);
+ Assert.True(consumer.LastSnapshotTruncated);
+ }
+ }
+
private static MxAlarmSnapshotRecord NewRecord(Guid guid, MxAlarmStateKind state)
{
return new MxAlarmSnapshotRecord
diff --git a/src/ZB.MOM.WW.MxGateway.Worker/MxAccess/AlarmCommandHandler.cs b/src/ZB.MOM.WW.MxGateway.Worker/MxAccess/AlarmCommandHandler.cs
index de60fce..534b9fa 100644
--- a/src/ZB.MOM.WW.MxGateway.Worker/MxAccess/AlarmCommandHandler.cs
+++ b/src/ZB.MOM.WW.MxGateway.Worker/MxAccess/AlarmCommandHandler.cs
@@ -342,6 +342,25 @@ public sealed class AlarmCommandHandler : IAlarmCommandHandler
return filtered;
}
+ ///
+ ///
+ /// Deliberately does not go through GetDispatcherOrThrow: an
+ /// unsubscribed handler has performed no fetch, and "no fetch" is not
+ /// truncated. Throwing here would turn a status read into a command
+ /// failure on a path the reply builder takes after the snapshot has
+ /// already been produced.
+ ///
+ public bool LastSnapshotTruncated
+ {
+ get
+ {
+ if (disposed) return false;
+ AlarmDispatcher? d;
+ lock (syncRoot) d = dispatcher;
+ return d is not null && d.LastSnapshotTruncated;
+ }
+ }
+
///
public void PollOnce()
{
diff --git a/src/ZB.MOM.WW.MxGateway.Worker/MxAccess/AlarmDispatcher.cs b/src/ZB.MOM.WW.MxGateway.Worker/MxAccess/AlarmDispatcher.cs
index accc2da..c5906c9 100644
--- a/src/ZB.MOM.WW.MxGateway.Worker/MxAccess/AlarmDispatcher.cs
+++ b/src/ZB.MOM.WW.MxGateway.Worker/MxAccess/AlarmDispatcher.cs
@@ -158,16 +158,28 @@ public sealed class AlarmDispatcher : IDisposable
public IReadOnlyList SnapshotActiveAlarms()
{
if (disposed) throw new ObjectDisposedException(nameof(AlarmDispatcher));
+ // Read the truncation verdict before the snapshot, so a poll landing
+ // between the two can only widen the warning (a stale "truncated" over a
+ // complete snapshot), never narrow it into a false all-clear.
+ bool truncated = consumer.LastSnapshotTruncated;
IReadOnlyList records = consumer.SnapshotActiveAlarms();
if (records.Count == 0) return Array.Empty();
List snapshots = new List(records.Count);
foreach (MxAlarmSnapshotRecord record in records)
{
- snapshots.Add(MapToSnapshot(record));
+ snapshots.Add(MapToSnapshot(record, truncated));
}
return snapshots;
}
+ ///
+ /// Whether the consumer's most recent fetch hit the per-fetch cap, so
+ /// the set returns may omit actives.
+ /// Stamped onto the QueryActiveAlarms reply payload, which is the only
+ /// carrier when the snapshot filters down to zero records.
+ ///
+ public bool LastSnapshotTruncated => !disposed && consumer.LastSnapshotTruncated;
+
private void OnTransition(object? sender, MxAlarmTransitionEvent transition)
{
if (disposed) return;
@@ -196,7 +208,7 @@ public sealed class AlarmDispatcher : IDisposable
degraded: record.Degraded);
}
- private static ActiveAlarmSnapshot MapToSnapshot(MxAlarmSnapshotRecord record)
+ private static ActiveAlarmSnapshot MapToSnapshot(MxAlarmSnapshotRecord record, bool truncated)
{
ActiveAlarmSnapshot snapshot = new ActiveAlarmSnapshot
{
@@ -212,6 +224,12 @@ public sealed class AlarmDispatcher : IDisposable
Description = string.Empty,
Degraded = record.Degraded,
SourceProvider = record.Degraded ? AlarmProviderMode.Subtag : AlarmProviderMode.Alarmmgr,
+ // Set-level status, stamped identically on every record of the
+ // snapshot: QueryActiveAlarms streams bare ActiveAlarmSnapshot
+ // messages with no envelope to hang it off. Independent of
+ // Degraded above — that is about this record's provider, this is
+ // about whether the set it belongs to is complete.
+ FromTruncatedSnapshot = truncated,
};
if (record.TransitionTimestampUtc != DateTime.MinValue)
{
diff --git a/src/ZB.MOM.WW.MxGateway.Worker/MxAccess/FailoverAlarmConsumer.cs b/src/ZB.MOM.WW.MxGateway.Worker/MxAccess/FailoverAlarmConsumer.cs
index 89896d2..9c69645 100644
--- a/src/ZB.MOM.WW.MxGateway.Worker/MxAccess/FailoverAlarmConsumer.cs
+++ b/src/ZB.MOM.WW.MxGateway.Worker/MxAccess/FailoverAlarmConsumer.cs
@@ -266,6 +266,17 @@ public sealed class FailoverAlarmConsumer : IMxAccessAlarmConsumer
return ActiveChild.SnapshotActiveAlarms();
}
+ ///
+ ///
+ /// Delegated to the active child, matching
+ /// : the flag describes the snapshot
+ /// the same child produced, so reading it off the standby would pair a
+ /// verdict with a snapshot it does not belong to. A failover to the
+ /// subtag standby therefore reports not-truncated — correctly, since
+ /// that child performs no capped fetch.
+ ///
+ public bool LastSnapshotTruncated => !disposed && ActiveChild.LastSnapshotTruncated;
+
private IMxAccessAlarmConsumer ActiveChild => active == Active.Primary ? primary : standby;
///
diff --git a/src/ZB.MOM.WW.MxGateway.Worker/MxAccess/IAlarmCommandHandler.cs b/src/ZB.MOM.WW.MxGateway.Worker/MxAccess/IAlarmCommandHandler.cs
index fa97078..bd8b6a9 100644
--- a/src/ZB.MOM.WW.MxGateway.Worker/MxAccess/IAlarmCommandHandler.cs
+++ b/src/ZB.MOM.WW.MxGateway.Worker/MxAccess/IAlarmCommandHandler.cs
@@ -74,6 +74,16 @@ public interface IAlarmCommandHandler : IDisposable
/// The currently active alarms matching the filter.
IReadOnlyList QueryActive(string? alarmFilterPrefix);
+ ///
+ /// Whether the consumer's most recent fetch hit the per-fetch cap, so
+ /// the set draws from may omit active alarms.
+ /// Stamped on the QueryActiveAlarms reply payload — the only carrier
+ /// once a prefix filter (or an empty galaxy) leaves zero records to
+ /// carry the per-record flag. when there is no
+ /// active subscription: no fetch has happened, so nothing is capped.
+ ///
+ bool LastSnapshotTruncated { get; }
+
///
/// Drives a single poll of the underlying alarm consumer on the
/// caller's thread. This is a no-op when there is no active
diff --git a/src/ZB.MOM.WW.MxGateway.Worker/MxAccess/IMxAccessAlarmConsumer.cs b/src/ZB.MOM.WW.MxGateway.Worker/MxAccess/IMxAccessAlarmConsumer.cs
index af7d1be..71f30e8 100644
--- a/src/ZB.MOM.WW.MxGateway.Worker/MxAccess/IMxAccessAlarmConsumer.cs
+++ b/src/ZB.MOM.WW.MxGateway.Worker/MxAccess/IMxAccessAlarmConsumer.cs
@@ -36,6 +36,20 @@ public interface IMxAccessAlarmConsumer : IDisposable
///
event EventHandler? AlarmTransitionEmitted;
+ ///
+ /// Whether the most recent fetch that reached the retained snapshot came
+ /// back holding the per-fetch cap. While this is
+ /// the snapshot returned by is
+ /// authoritative about presence only: the provider may hold actives it
+ /// had no room to report, and the consumer has suspended the
+ /// absence-implies-Clear inference. Not latched — the first sub-cap fetch
+ /// after a run of capped ones clears it, because that fetch is complete
+ /// and the snapshot it produced is again authoritative about absence.
+ /// Consumers with no per-fetch cap (the subtag fallback, which is
+ /// event-driven) always report .
+ ///
+ bool LastSnapshotTruncated { get; }
+
///
/// Initializes the AVEVA alarm-client connection, registers as a
/// consumer, and subscribes to the supplied alarm-provider expression.
diff --git a/src/ZB.MOM.WW.MxGateway.Worker/MxAccess/MxAccessCommandExecutor.cs b/src/ZB.MOM.WW.MxGateway.Worker/MxAccess/MxAccessCommandExecutor.cs
index 15019f4..f1ada4b 100644
--- a/src/ZB.MOM.WW.MxGateway.Worker/MxAccess/MxAccessCommandExecutor.cs
+++ b/src/ZB.MOM.WW.MxGateway.Worker/MxAccess/MxAccessCommandExecutor.cs
@@ -977,6 +977,10 @@ public sealed class MxAccessCommandExecutor : IStaCommandExecutor
command.Command.QueryActiveAlarmsCommand.AlarmFilterPrefix);
QueryActiveAlarmsReplyPayload payload = new QueryActiveAlarmsReplyPayload();
payload.Snapshots.AddRange(snapshots);
+ // Set-level degraded status: the snapshot may omit actives because
+ // the provider fetch hit its cap. The records carry the same flag,
+ // but a prefix filter can leave none, so the payload states it too.
+ payload.SnapshotTruncated = alarmCommandHandler.LastSnapshotTruncated;
MxCommandReply reply = CreateOkReply(command);
reply.QueryActiveAlarms = payload;
return reply;
diff --git a/src/ZB.MOM.WW.MxGateway.Worker/MxAccess/SubtagAlarmConsumer.cs b/src/ZB.MOM.WW.MxGateway.Worker/MxAccess/SubtagAlarmConsumer.cs
index c02b519..754a36d 100644
--- a/src/ZB.MOM.WW.MxGateway.Worker/MxAccess/SubtagAlarmConsumer.cs
+++ b/src/ZB.MOM.WW.MxGateway.Worker/MxAccess/SubtagAlarmConsumer.cs
@@ -45,6 +45,16 @@ public sealed class SubtagAlarmConsumer : IMxAccessAlarmConsumer
/// Fires once per synthesized alarm-state transition.
public event EventHandler? AlarmTransitionEmitted;
+ ///
+ ///
+ /// Always . Subtag mode is advise-driven over a
+ /// fixed watch list — there is no bulk fetch and therefore no per-fetch
+ /// cap to hit. Subtag snapshots are lower-fidelity in other ways, which
+ /// MxAlarmSnapshotRecord.Degraded already reports; truncation is
+ /// not one of them.
+ ///
+ public bool LastSnapshotTruncated => false;
+
///
/// Initializes the consumer over a subtag source and a watch list of
/// alarm targets.
diff --git a/src/ZB.MOM.WW.MxGateway.Worker/MxAccess/WnWrapAlarmConsumer.cs b/src/ZB.MOM.WW.MxGateway.Worker/MxAccess/WnWrapAlarmConsumer.cs
index 041e901..0f07764 100644
--- a/src/ZB.MOM.WW.MxGateway.Worker/MxAccess/WnWrapAlarmConsumer.cs
+++ b/src/ZB.MOM.WW.MxGateway.Worker/MxAccess/WnWrapAlarmConsumer.cs
@@ -93,6 +93,7 @@ public sealed class WnWrapAlarmConsumer : IMxAccessAlarmConsumer
private long lastTruncationWarningMilliseconds = -TruncationWarningIntervalMilliseconds;
private long truncatedFetchCount;
+ private bool lastSnapshotTruncated;
private wwAlarmConsumerClass? client;
private wwAlarmConsumerClass? ackClient;
private bool subscribed;
@@ -125,6 +126,23 @@ public sealed class WnWrapAlarmConsumer : IMxAccessAlarmConsumer
: DefaultMaxAlarmsPerFetch;
}
+ ///
+ /// COM-free construction, for exercising the retained-snapshot state
+ /// machine ( /
+ /// / ) on a machine without AVEVA
+ /// installed. throws and
+ /// no-ops on an instance built this way — both need the wnwrap coclass,
+ /// which cannot be instantiated on the macOS/Linux test matrix. Internal
+ /// rather than public so it cannot be reached from production wiring.
+ ///
+ /// Maximum alarms per fetch call.
+ internal WnWrapAlarmConsumer(int maxAlarmsPerFetch)
+ {
+ this.maxAlarmsPerFetch = maxAlarmsPerFetch > 0
+ ? maxAlarmsPerFetch
+ : DefaultMaxAlarmsPerFetch;
+ }
+
///
/// Resolves the per-fetch cap from the launcher-provided environment
/// variable. A missing, unparseable, or out-of-range value falls back
@@ -373,6 +391,18 @@ public sealed class WnWrapAlarmConsumer : IMxAccessAlarmConsumer
}
}
+ ///
+ ///
+ /// Read without the disposed guard
+ /// carries: this is degraded-status metadata a reply builder stamps
+ /// alongside a snapshot, and throwing from it would fail a query whose
+ /// snapshot half succeeded.
+ ///
+ public bool LastSnapshotTruncated
+ {
+ get { lock (syncRoot) { return lastSnapshotTruncated; } }
+ }
+
///
/// Sink for the rate-limited truncated-fetch warning. Defaults to
/// , the stream
@@ -413,14 +443,8 @@ public sealed class WnWrapAlarmConsumer : IMxAccessAlarmConsumer
// docs/AlarmProbeFindings.md.)
bool truncated = IsTruncatedFetch(fetchedRecordCount, maxAlarmsPerFetch);
- IReadOnlyList transitions;
- int retainedCount;
- lock (syncRoot)
- {
- transitions = ComputeTransitions(latestSnapshot, next);
- ApplySnapshotUpdate(latestSnapshot, next, truncated);
- retainedCount = latestSnapshot.Count;
- }
+ IReadOnlyList transitions =
+ FoldFetch(next, truncated, out int retainedCount);
if (truncated)
{
@@ -436,6 +460,37 @@ public sealed class WnWrapAlarmConsumer : IMxAccessAlarmConsumer
}
}
+ ///
+ /// Folds one fetch into the retained state under a single lock: the
+ /// transition diff, the snapshot merge/replace, and the truncation
+ /// verdict move together. Splitting them would let a concurrent
+ /// /
+ /// pair read a capped snapshot alongside the previous poll's "complete"
+ /// verdict — precisely the false all-clear the signal exists to prevent.
+ /// The verdict is replaced, never latched: a sub-cap fetch is complete
+ /// and restores absence authority, so leaving the flag set would strand
+ /// the operator banner on after a single burst.
+ ///
+ /// The snapshot just parsed from the fetch.
+ /// Whether the fetch hit the per-fetch cap.
+ /// Size of the retained snapshot after the fold.
+ /// The transitions the fetch implies.
+ internal IReadOnlyList FoldFetch(
+ Dictionary next,
+ bool truncated,
+ out int retainedCount)
+ {
+ lock (syncRoot)
+ {
+ IReadOnlyList transitions =
+ ComputeTransitions(latestSnapshot, next);
+ ApplySnapshotUpdate(latestSnapshot, next, truncated);
+ lastSnapshotTruncated = truncated;
+ retainedCount = latestSnapshot.Count;
+ return transitions;
+ }
+ }
+
///
/// Decides whether a fetch that came back holding
/// records hit the cap.