fix(central-ui): resolve CentralUI-007..014 — nav authz, UTC date filters, disposal guards, N+1 fix, async script analysis

tests/ScadaLink.CentralUI.Tests/Design/TestRunWarningTests.cs

@@ -0,0 +1,58 @@
+namespace ScadaLink.CentralUI.Tests.Design;
+
+/// <summary>
+/// Regression tests for CentralUI-014. Test Run wires <c>External</c>,
+/// <c>Database</c>, and <c>Notify</c> to central's real services, so a Test Run
+/// has production-equivalent side effects. The finding asked, at minimum, that
+/// this blast radius be surfaced to the user. The Test Run panels in
+/// <c>SharedScriptForm</c> and <c>TemplateEdit</c> carry a prominent
+/// <c>Real I/O</c> badge and an <c>alert-warning</c> block stating the side
+/// effects are real and permanent; <c>ApiMethodForm</c> (Inbound API kind) has
+/// no real-I/O surface at all and correctly omits the badge. These tests pin
+/// that warning so it cannot silently regress.
+/// </summary>
+public class TestRunWarningTests
+{
+    private static string SrcRoot
+    {
+        get
+        {
+            // tests/ScadaLink.CentralUI.Tests/bin/Debug/net10.0 → repo root.
+            var dir = AppContext.BaseDirectory;
+            for (var i = 0; i < 6 && dir is not null; i++)
+                dir = Directory.GetParent(dir)?.FullName;
+            return Path.Combine(dir!, "src", "ScadaLink.CentralUI",
+                "Components", "Pages", "Design");
+        }
+    }
+
+    private static string Read(string fileName)
+        => File.ReadAllText(Path.Combine(SrcRoot, fileName));
+
+    [Theory]
+    [InlineData("SharedScriptForm.razor")]
+    [InlineData("TemplateEdit.razor")]
+    public void TestRunPanel_WithRealIoSurface_ShowsRealIoBadgeAndWarning(string razorFile)
+    {
+        var markup = Read(razorFile);
+
+        // The "Real I/O" badge on the Test Run panel header.
+        Assert.Contains("Real I/O", markup);
+        // The explicit warning that side effects hit real systems and are permanent.
+        Assert.Contains("alert-warning", markup);
+        Assert.Contains("fire for real", markup);
+        Assert.Contains("Side effects are permanent", markup);
+    }
+
+    [Fact]
+    public void ApiMethodForm_TestRun_HasNoRealIoBadge_BecauseInboundApiHasNoSideEffectSurface()
+    {
+        // The Inbound API sandbox host exposes only Parameters / Route (Route
+        // throws) — there is no External/Database/Notify, so no "Real I/O".
+        var markup = Read("ApiMethodForm.razor");
+
+        Assert.DoesNotContain("Real I/O", markup);
+        // It still warns that Route calls throw.
+        Assert.Contains("alert-warning", markup);
+    }
+}