Joseph Doherty
7e7f7cad84
SEC-33: make rooting host-meaningful and stop shipping foreign-platform literals. - Delete IsRootedForAnyPlatform; AddIfNotRooted now uses Path.IsPathRooted (current OS). - Promote AddIfNotRooted/AddIfInvalidPath to shared GatewayConfigPathRules so the new Galaxy validator reuses them and the two validators cannot drift. - Remove Authentication:SqlitePath and Galaxy:SnapshotCachePath Windows literals from appsettings.json; the CommonApplicationData-derived code defaults take over. The Galaxy default is seeded as a configuration value before AddZbGalaxyRepository (SnapshotCachePath is init-only, so a PostConfigure mutation cannot compile). - New GalaxyRepositoryOptionsValidator (ValidateOnStart) enforces a valid, host-rooted SnapshotCachePath when PersistSnapshot is true. - Root-cause the stray junk-named auth DB: host start eagerly builds AuthSqliteConnectionFactory; under the non-rooted Windows literal on macOS SQLite wrote it relative to the test bin CWD. The three real-host-start tests now pin SqlitePath to a temp path. SEC-34: verification cache Invalidate-vs-in-flight-repopulation race closed with a per-key generation counter (bump-before-evict, snapshot-then-recheck). The expiry cap (window 2) takes the documented fallback: the library verification identity carries no ExpiresUtc, so the cache cannot cap at the key's expiry (donor-library ask). GWC-24 rider: cap MxGateway:Events:QueueCapacity at int.MaxValue/2 so the derived checked(2 * EventChannelCapacity) in WorkerClient cannot overflow at session creation. SEC-35 (doc-only): note IsProduction() env-name semantics in GatewayConfiguration.md. Docs updated same commit (GatewayConfiguration.md, Authentication.md) and tracking registers/change-log flipped (00-tracking.md, 40-security-dashboard.md).
42 lines
1.8 KiB
C#
42 lines
1.8 KiB
C#
using ZB.MOM.WW.Configuration;
|
|
using ZB.MOM.WW.GalaxyRepository;
|
|
|
|
namespace ZB.MOM.WW.MxGateway.Server.Configuration;
|
|
|
|
/// <summary>
|
|
/// Gateway-side startup validation for the shared <see cref="GalaxyRepositoryOptions"/>. The
|
|
/// <c>ZB.MOM.WW.GalaxyRepository</c> package binds the options but deliberately ships no validator
|
|
/// (see <c>A2-galaxyrepository-adoption-handoff.md</c>); the gateway owns the rule because it is the
|
|
/// process that writes the snapshot. When persistence is on, the snapshot path must be a valid,
|
|
/// rooted path on the running host for the same reason the auth DB path must be (SEC-33): a
|
|
/// non-rooted value silently resolves against the launch working directory.
|
|
/// </summary>
|
|
public sealed class GalaxyRepositoryOptionsValidator : OptionsValidatorBase<GalaxyRepositoryOptions>
|
|
{
|
|
/// <inheritdoc />
|
|
protected override void Validate(ValidationBuilder builder, GalaxyRepositoryOptions options)
|
|
{
|
|
if (!options.PersistSnapshot)
|
|
{
|
|
// Persistence disabled: the snapshot path is never used, so nothing to validate.
|
|
return;
|
|
}
|
|
|
|
if (string.IsNullOrWhiteSpace(options.SnapshotCachePath))
|
|
{
|
|
builder.Add(
|
|
"MxGateway:Galaxy:SnapshotCachePath is required when MxGateway:Galaxy:PersistSnapshot is true.");
|
|
return;
|
|
}
|
|
|
|
GatewayConfigPathRules.AddIfInvalidPath(
|
|
options.SnapshotCachePath,
|
|
"MxGateway:Galaxy:SnapshotCachePath must be a valid filesystem path.",
|
|
builder);
|
|
GatewayConfigPathRules.AddIfNotRooted(
|
|
options.SnapshotCachePath,
|
|
"MxGateway:Galaxy:SnapshotCachePath must be an absolute (rooted) path so the Galaxy snapshot never lands in the launch working directory.",
|
|
builder);
|
|
}
|
|
}
|