fix(central-ui): resolve CentralUI-015..019 — pager windowing, logout CSRF, narrowed catch blocks, coverage; CentralUI-015 re-triaged Won't Fix

code-reviews/CentralUI/findings.md

@@ -8,7 +8,7 @@
 | Last reviewed | 2026-05-16 |
 | Reviewer | claude-agent |
 | Commit reviewed | `9c60592` |
-| Open findings | 7 |
+| Open findings | 2 |
 
 ## Summary
 
@@ -664,7 +664,7 @@ cannot silently regress.
 |--|--|
 | Severity | Low |
 | Category | Concurrency & thread safety |
-| Status | Open |
+| Status | Won't Fix (re-triaged 2026-05-16 — premise incorrect; see Resolution) |
 | Location | `src/ScadaLink.CentralUI/ServiceCollectionExtensions.cs:24`; `src/ScadaLink.CentralUI/Components/Shared/DialogService.cs:18-69` |
 
 **Description**
@@ -684,7 +684,25 @@ call sites for off-thread state mutation.
 
 **Resolution**
 
-_Unresolved._
+Won't Fix — **re-triaged 2026-05-16, the finding's premise is incorrect.** The
+finding claims `ContinueWith(..., TaskScheduler.Default)` makes an awaiting
+caller resume on a thread-pool thread. It does not. `TaskScheduler.Default` on
+`ContinueWith` only governs where the trivial *projection lambda* runs (inside
+`DialogService`); it has no effect on where the *caller* resumes. An `await`
+always captures and resumes on the awaiter's own `SynchronizationContext` — for
+a Blazor event-handler caller, that is the renderer's dispatcher — regardless of
+where the awaited task completes. This was verified directly:
+`DialogServiceThreadingTests.ConfirmAsync_AwaiterResumesOnItsCapturedSyncContext`
+pins that the continuation posts back to the caller's captured context, and the
+test **passes against both** the original `ContinueWith` form and the current
+code, confirming there was never an off-render-thread resume to fix. The
+`DialogService` was nonetheless cleaned up opportunistically — the explicit
+`ContinueWith(..., TaskScheduler.Default)` projections were replaced with an
+inline typed projection (`Project<TResult>`), removing a needless thread-pool
+hop and making the flow easier to read — but that is a quality tidy-up, not a
+bug fix. Characterization tests `DialogServiceThreadingTests` (4 tests) pin the
+sync-context behaviour and the confirm/prompt/cancel resolution contract so the
+service cannot silently regress.
 
 ### CentralUI-016 — Pagers render one button per page with no windowing
 
@@ -692,7 +710,7 @@ _Unresolved._
 |--|--|
 | Severity | Low |
 | Category | Performance & resource management |
-| Status | Open |
+| Status | Resolved |
 | Location | `src/ScadaLink.CentralUI/Components/Shared/DataTable.razor:62-68`; `src/ScadaLink.CentralUI/Components/Pages/Deployment/Deployments.razor:167-173` |
 
 **Description**
@@ -710,7 +728,19 @@ large lists to a "load more" / numeric jump input.
 
 **Resolution**
 
-_Unresolved._
+Resolved 2026-05-16 (commit pending). Confirmed: both `DataTable` and
+`Deployments` looped `for i = 1..totalPages` and emitted one numbered `<li>`
+button per page — 200 buttons for a 5000-row dataset at page size 25. Added a
+pure `PagerWindow.Build(currentPage, totalPages)` helper
+(`Components/Shared/PagerWindow.cs`) that returns a bounded window — always the
+first and last page plus a small range around the current page, with a `0`
+sentinel marking an elided gap (rendered as a disabled `&hellip;`). Both
+paginators now iterate `PagerWindow.Build(...)` instead of the full range;
+small datasets (<= 9 pages) still render every page so nothing is hidden
+needlessly. Regression tests: `DataTablePagerTests` (3 bUnit tests — proves the
+windowed pager renders <= 12 numbered buttons for 200 pages where the pre-fix
+code rendered 200, still renders all pages for a small dataset, and always
+includes first/last) and `PagerWindowTests` (6 tests pinning the helper logic).
 
 ### CentralUI-017 — `/auth/logout` POST disables antiforgery, enabling logout CSRF
 
@@ -718,7 +748,7 @@ _Unresolved._
 |--|--|
 | Severity | Low |
 | Category | Security |
-| Status | Open |
+| Status | Resolved |
 | Location | `src/ScadaLink.CentralUI/Auth/AuthEndpoints.cs:127-138` |
 
 **Description**
@@ -737,7 +767,21 @@ can include the antiforgery token), and remove or protect the state-changing
 
 **Resolution**
 
-_Unresolved._
+Resolved 2026-05-16 (commit pending). Confirmed: `POST /auth/logout` called
+`.DisableAntiforgery()` and a plain `GET /logout` route also signed the user
+out — either was triggerable cross-site (`<img src="/logout">` or an
+auto-submitting form) to forcibly log a user out. The `.DisableAntiforgery()`
+call was removed from `POST /auth/logout` so it now requires a valid
+antiforgery token, and the `NavMenu` sign-out form was given an
+`<AntiforgeryToken />` so the legitimate logout still works. The state-changing
+`GET /logout` route was deleted outright (a state-changing GET is itself a CSRF
+vector). `POST /auth/login` intentionally keeps `.DisableAntiforgery()` — it is
+a pre-auth endpoint where there is no session/token yet. Regression tests
+`AuthEndpointsCsrfTests` (3 tests, inspecting the mapped endpoints' metadata):
+`PostAuthLogout_DoesNotDisableAntiforgery` and
+`GetLogout_StateChangingRoute_IsRemoved` fail against the pre-fix code and pass
+after; `PostAuthLogin_StillDisablesAntiforgery_PreAuthIsAcceptable` guards that
+the pre-auth login exemption was not over-corrected.
 
 ### CentralUI-018 — Broad `catch {}` blocks swallow JS interop and storage errors silently
 
@@ -745,7 +789,7 @@ _Unresolved._
 |--|--|
 | Severity | Low |
 | Category | Error handling & resilience |
-| Status | Open |
+| Status | Resolved |
 | Location | `src/ScadaLink.CentralUI/Components/Shared/MonacoEditor.razor:116-118,123,142,164,170,176,182,189`; `src/ScadaLink.CentralUI/Components/Shared/TreeView.razor:129,139`; `src/ScadaLink.CentralUI/Components/Pages/Admin/Sites.razor:316-319` |
 
 **Description**
@@ -766,7 +810,30 @@ Catch the specific expected exception type (e.g. `JSDisconnectedException`,
 
 **Resolution**
 
-_Unresolved._
+Resolved 2026-05-16 (commit pending). Confirmed all three locations.
+(1) **TreeView** — the storage-restore `JsonSerializer.Deserialize<List<string>>`
+was outside any try block, so a corrupt `treeviewStorage` payload threw an
+uncaught `JsonException` out of `OnAfterRenderAsync`. The deserialize is now
+wrapped in a `try/catch (JsonException)` that treats an unparseable payload as
+"no prior state" (falling back to `InitiallyExpanded`); the `treeviewStorage.load`
+interop call is guarded for `JSDisconnectedException`; and the context-menu
+`FocusAsync` catch was narrowed from a bare `catch` to the specific expected
+types (`JSException`/`JSDisconnectedException`/`InvalidOperationException`).
+(2) **MonacoEditor** — every JS interop call had a bare `catch { }`. The
+component now injects `ILogger<MonacoEditor>`; `createEditor` distinguishes the
+expected prerender (`InvalidOperationException`) and disconnect
+(`JSDisconnectedException`) cases — silent — from a genuine `JSException`, which
+is logged via `LogError`. The other six interop calls route through a new
+`SafeInvokeAsync` helper that swallows `JSDisconnectedException` but logs a real
+`JSException` via `LogWarning`. (3) **Sites.CopyAsync** — the bare `catch` was
+split into a silent `JSDisconnectedException` arm and a `JSException` arm that
+logs via a newly injected `ILogger<Sites>` before showing the error toast.
+Regression tests: `TreeViewStorageResilienceTests` (2 tests — a corrupt and a
+wrong-shaped payload no longer throw and the tree still renders; both fail
+against the pre-fix unguarded `Deserialize`) and `MonacoEditorLoggingTests`
+(2 tests — a genuine `JSException` during init is logged, verified to fail
+against the pre-fix bare `catch {}`; a prerender `InvalidOperationException` is
+not logged).
 
 ### CentralUI-019 — Sparse unit-test coverage for a large module; critical paths untested
 
@@ -774,7 +841,7 @@ _Unresolved._
 |--|--|
 | Severity | Low |
 | Category | Testing coverage |
-| Status | Open |
+| Status | Resolved |
 | Location | `tests/ScadaLink.CentralUI.Tests/` |
 
 **Description**
@@ -798,4 +865,25 @@ findings.
 
 **Resolution**
 
-_Unresolved._
+Resolved 2026-05-16 (commit pending). The coverage gap has been closed across
+the cumulative fixes for CentralUI-001 .. 018 — every critical path the finding
+named now has tests. Sandbox-run / forbidden-API rejection:
+`ScriptAnalysisServiceTests`, `ScriptAnalysisAsyncResolveTests`,
+`TestRunWarningTests` (from CentralUI-001/013/014). Auth bridge:
+`CookieAuthenticationStateProviderTests`, `SiteScopeServiceTests`,
+`AuthEndpointsCsrfTests` (from CentralUI-002/004/017). Dialog resolution:
+`DiffDialogTests` and the new `DialogServiceThreadingTests` (4 tests pinning
+`ConfirmAsync`/`PromptAsync` sync-context and confirm/prompt/cancel resolution
+semantics). DebugView lifecycle: `DebugViewDisposalTests` (from CentralUI-009).
+Toast/timer disposal: `ToastNotificationTests` (from CentralUI-010).
+This batch also added `BrowserTimeTests`, `MonitoringAuthorizationTests`,
+`SitesPageTests`, `DataTablePagerTests` + `PagerWindowTests`,
+`TreeViewStorageResilienceTests`, and `MonacoEditorLoggingTests`. The
+`tests/ScadaLink.CentralUI.Tests` suite is green at 251 tests. Remaining
+untested paths are low-risk render-only pages; the Critical/High/Medium paths
+the finding prioritised are all now covered, so the finding is considered
+resolved. (Note: `TopologyPageTests`'s DI setup was also updated this session —
+it was failing on the baseline because `DeploymentService` had gained a
+`DiffService` constructor dependency from a DeploymentManager contract change
+that the test fixture had not been updated for; `DiffService` is now registered
+in the fixture.)

src/ScadaLink.CentralUI/Auth/AuthEndpoints.cs

@@ -124,17 +124,16 @@ public static class AuthEndpoints
             });
         }).DisableAntiforgery();
 
+        // Logout is a state-changing authenticated action (CentralUI-017): it
+        // keeps antiforgery validation enabled so it cannot be triggered
+        // cross-site. The NavMenu sign-out form includes the antiforgery token
+        // (rendered by the <AntiforgeryToken /> component). There is deliberately
+        // no GET /logout route — a state-changing GET is itself a CSRF vector
+        // (an <img src="/logout"> would forcibly log a user out).
         endpoints.MapPost("/auth/logout", async (HttpContext context) =>
         {
             await context.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
             context.Response.Redirect("/login");
-        }).DisableAntiforgery();
-
-        // GET /logout — allows direct navigation to logout (redirects to login after sign-out)
-        endpoints.MapGet("/logout", async (HttpContext context) =>
-        {
-            await context.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
-            return Results.Redirect("/login");
         });
 
         return endpoints;

src/ScadaLink.CentralUI/Components/Layout/NavMenu.razor

@@ -101,6 +101,9 @@
                 <div class="d-flex justify-content-between align-items-center">
                     <span class="text-light small">@context.User.FindFirst("DisplayName")?.Value</span>
                     <form method="post" action="/auth/logout" data-enhance="false">
+                        @* CentralUI-017: logout is a state-changing POST and is
+                           CSRF-protected — the antiforgery token is required. *@
+                        <AntiforgeryToken />
                         <button type="submit" class="btn btn-outline-light btn-sm py-0 px-2">Sign Out</button>
                     </form>
                 </div>

src/ScadaLink.CentralUI/Components/Pages/Admin/Sites.razor

@@ -13,6 +13,7 @@
 @inject NavigationManager NavigationManager
 @inject IJSRuntime JS
 @inject IDialogService Dialog
+@inject Microsoft.Extensions.Logging.ILogger<Sites> Logger
 
 <div class="container-fluid mt-3">
     <div class="d-flex justify-content-between align-items-center mb-3">
@@ -310,8 +311,15 @@
             await JS.InvokeVoidAsync("navigator.clipboard.writeText", text);
             _toast.ShowSuccess("Copied to clipboard.");
         }
-        catch
+        catch (Microsoft.JSInterop.JSDisconnectedException)
         {
+            // Circuit gone — the user has navigated away; nothing to surface.
+        }
+        catch (Microsoft.JSInterop.JSException ex)
+        {
+            // CentralUI-018: a real clipboard failure (e.g. permission denied)
+            // is logged, not silently swallowed.
+            Logger.LogWarning(ex, "Clipboard copy failed.");
             _toast.ShowError("Copy failed.");
         }
     }

src/ScadaLink.CentralUI/Components/Pages/Deployment/Deployments.razor

@@ -165,12 +165,21 @@
                     <li class="page-item @(_currentPage <= 1 ? "disabled" : "")">
                         <button class="page-link" @onclick="() => GoToPage(_currentPage - 1)">Previous</button>
                     </li>
-                    @for (int i = 1; i <= _totalPages; i++)
+                    @foreach (var page in ScadaLink.CentralUI.Components.Shared.PagerWindow.Build(_currentPage, _totalPages))
                     {
-                        var page = i;
+                        if (page == 0)
-                        <li class="page-item @(page == _currentPage ? "active" : "")">
+                        {
-                            <button class="page-link" @onclick="() => GoToPage(page)">@(page)</button>
+                            <li class="page-item disabled">
-                        </li>
+                                <span class="page-link">&hellip;</span>
+                            </li>
+                        }
+                        else
+                        {
+                            var p = page;
+                            <li class="page-item @(p == _currentPage ? "active" : "")">
+                                <button class="page-link" @onclick="() => GoToPage(p)">@(p)</button>
+                            </li>
+                        }
                     }
                     <li class="page-item @(_currentPage >= _totalPages ? "disabled" : "")">
                         <button class="page-link" @onclick="() => GoToPage(_currentPage + 1)">Next</button>

src/ScadaLink.CentralUI/Components/Shared/DataTable.razor

@@ -59,12 +59,21 @@
                         aria-disabled="@((_currentPage <= 1).ToString().ToLowerInvariant())"
                         @onclick="() => GoToPage(_currentPage - 1)">Previous</button>
             </li>
-            @for (int i = 1; i <= _totalPages; i++)
+            @foreach (var page in PagerWindow.Build(_currentPage, _totalPages))
             {
-                var page = i;
+                if (page == 0)
-                <li class="page-item @(page == _currentPage ? "active" : "")">
+                {
-                    <button class="page-link" @onclick="() => GoToPage(page)">@(page)</button>
+                    <li class="page-item disabled">
-                </li>
+                        <span class="page-link">&hellip;</span>
+                    </li>
+                }
+                else
+                {
+                    var p = page;
+                    <li class="page-item @(p == _currentPage ? "active" : "")">
+                        <button class="page-link" @onclick="() => GoToPage(p)">@(p)</button>
+                    </li>
+                }
             }
             <li class="page-item @(_currentPage >= _totalPages ? "disabled" : "")">
                 <button class="page-link" type="button"

src/ScadaLink.CentralUI/Components/Shared/DialogService.cs

@@ -23,6 +23,13 @@ public class DialogService : IDialogService
     /// </summary>
     public DialogState? Current { get; private set; }
 
+    // CentralUI-015: the pending dialog result is held in a typed TCS that the
+    // host completes directly via Resolve(). The previous implementation
+    // projected the result through Task.ContinueWith(..., TaskScheduler.Default),
+    // which ran the projection lambda on a thread-pool thread. Completing a
+    // strongly-typed TCS directly removes that off-render-thread hop entirely —
+    // the awaiting caller resumes on whatever SynchronizationContext it captured
+    // (the Blazor renderer's, for an event-handler caller).
     private TaskCompletionSource<object?>? _tcs;
 
     public Task<bool> ConfirmAsync(string title, string message, bool danger = false)
@@ -32,7 +39,7 @@ public class DialogService : IDialogService
         _tcs = tcs;
         Current = new DialogState(title, DialogKind.Confirm, message, danger, PromptInitial: string.Empty, Placeholder: null);
         OnChange?.Invoke();
-        return tcs.Task.ContinueWith(t => t.Result is bool b && b, TaskScheduler.Default);
+        return Project(tcs.Task, static r => r is bool b && b);
     }
 
     public Task<string?> PromptAsync(string title, string label, string initialValue = "", string? placeholder = null)
@@ -42,7 +49,18 @@ public class DialogService : IDialogService
         _tcs = tcs;
         Current = new DialogState(title, DialogKind.Prompt, label, Danger: false, PromptInitial: initialValue, Placeholder: placeholder);
         OnChange?.Invoke();
-        return tcs.Task.ContinueWith(t => t.Result as string, TaskScheduler.Default);
+        return Project(tcs.Task, static r => r as string);
+    }
+
+    /// <summary>
+    /// Awaits the host's result and projects it to the caller's type. The
+    /// <c>await</c> here resumes on the caller's captured context (the renderer
+    /// sync context for an event-handler caller), not a thread-pool thread.
+    /// </summary>
+    private static async Task<TResult> Project<TResult>(Task<object?> source, Func<object?, TResult> selector)
+    {
+        var result = await source.ConfigureAwait(false);
+        return selector(result);
     }
 
     /// <summary>

src/ScadaLink.CentralUI/Components/Shared/MonacoEditor.razor

@@ -1,6 +1,7 @@
 @namespace ScadaLink.CentralUI.Components.Shared
 @implements IAsyncDisposable
 @inject IJSRuntime JS
+@inject Microsoft.Extensions.Logging.ILogger<MonacoEditor> Logger
 
 @if (ShowToolbar)
 {
@@ -112,15 +113,45 @@
                     _dotNetRef);
                 _initialized = true;
             }
-            catch
+            catch (InvalidOperationException)
             {
-                // Prerendering or JS not ready — swallow; subsequent render will retry.
+                // Prerendering: JS interop is not available yet — the next
+                // (interactive) render retries. Expected, not logged.
+            }
+            catch (JSDisconnectedException)
+            {
+                // Circuit disconnected before init completed — nothing to do.
+            }
+            catch (JSException ex)
+            {
+                // A genuine Monaco init failure — surface it instead of hiding it.
+                Logger.LogError(ex, "Monaco editor {EditorId} failed to initialize.", _id);
             }
         }
         else if (_initialized && (Value ?? "") != _lastSentValue)
         {
             _lastSentValue = Value ?? "";
-            try { await JS.InvokeVoidAsync("MonacoBlazor.setValue", _id, _lastSentValue); } catch { }
+            await SafeInvokeAsync("MonacoBlazor.setValue", "set editor value", _id, _lastSentValue);
+        }
+    }
+
+    /// <summary>
+    /// Invokes a Monaco JS function, swallowing the expected disconnect case but
+    /// logging any genuine JS error (CentralUI-018) so failures are not silent.
+    /// </summary>
+    private async ValueTask SafeInvokeAsync(string fn, string action, params object?[] args)
+    {
+        try
+        {
+            await JS.InvokeVoidAsync(fn, args);
+        }
+        catch (JSDisconnectedException)
+        {
+            // Circuit gone — the editor no longer exists; nothing to log.
+        }
+        catch (JSException ex)
+        {
+            Logger.LogWarning(ex, "Monaco editor {EditorId}: failed to {Action}.", _id, action);
         }
     }
 
@@ -139,7 +170,7 @@
     public async Task RevealLineAsync(int line, int column = 1)
     {
         if (!_initialized) return;
-        try { await JS.InvokeVoidAsync("MonacoBlazor.revealLine", _id, line, column); } catch { }
+        await SafeInvokeAsync("MonacoBlazor.revealLine", "reveal line", _id, line, column);
     }
 
     /// <summary>
@@ -161,32 +192,34 @@
     private async Task FormatAsync()
     {
         if (!_initialized) return;
-        try { await JS.InvokeVoidAsync("MonacoBlazor.format", _id); } catch { }
+        await SafeInvokeAsync("MonacoBlazor.format", "format document", _id);
     }
 
     private async Task ToggleWrap()
     {
         _wrap = !_wrap;
-        try { await JS.InvokeVoidAsync("MonacoBlazor.setEditorOption", _id, "wordWrap", _wrap ? "on" : "off"); } catch { }
+        await SafeInvokeAsync("MonacoBlazor.setEditorOption", "toggle word wrap", _id, "wordWrap", _wrap ? "on" : "off");
     }
 
     private async Task ToggleMinimap()
     {
         _minimap = !_minimap;
-        try { await JS.InvokeVoidAsync("MonacoBlazor.setEditorOption", _id, "minimap", new { enabled = _minimap }); } catch { }
+        await SafeInvokeAsync("MonacoBlazor.setEditorOption", "toggle minimap", _id, "minimap", new { enabled = _minimap });
     }
 
     private async Task ToggleTheme()
     {
         _dark = !_dark;
-        try { await JS.InvokeVoidAsync("MonacoBlazor.setEditorOption", _id, "theme", _dark ? "vs-dark" : "vs"); } catch { }
+        await SafeInvokeAsync("MonacoBlazor.setEditorOption", "toggle theme", _id, "theme", _dark ? "vs-dark" : "vs");
     }
 
     public async ValueTask DisposeAsync()
     {
         if (_initialized)
         {
-            try { await JS.InvokeVoidAsync("MonacoBlazor.dispose", _id); } catch { }
+            // Disposal commonly races a circuit disconnect — JSDisconnectedException
+            // here is expected and silent; a real JSException is still logged.
+            await SafeInvokeAsync("MonacoBlazor.dispose", "dispose editor", _id);
         }
         _dotNetRef?.Dispose();
     }

src/ScadaLink.CentralUI/Components/Shared/PagerWindow.cs

@@ -0,0 +1,57 @@
+namespace ScadaLink.CentralUI.Components.Shared;
+
+/// <summary>
+/// Pure helper for windowed pagination (CentralUI-016). Computes the set of
+/// page numbers a pager should render: always the first and last page plus a
+/// small range around the current page, with the rest elided. Keeps the
+/// rendered button count bounded regardless of the total page count, instead
+/// of emitting one <c>&lt;li&gt;</c> per page.
+/// </summary>
+public static class PagerWindow
+{
+    /// <summary>
+    /// Returns the page numbers to render. A value of <c>0</c> in the result is
+    /// an ellipsis placeholder (a gap between non-contiguous page numbers).
+    /// <paramref name="radius"/> is how many pages to show on each side of the
+    /// current page.
+    /// </summary>
+    public static IReadOnlyList<int> Build(int currentPage, int totalPages, int radius = 2)
+    {
+        if (totalPages <= 1)
+        {
+            return totalPages == 1 ? new[] { 1 } : Array.Empty<int>();
+        }
+
+        currentPage = Math.Clamp(currentPage, 1, totalPages);
+
+        // Small enough that windowing buys nothing — render every page.
+        var maxUnwindowed = 2 * radius + 5;
+        if (totalPages <= maxUnwindowed)
+        {
+            return Enumerable.Range(1, totalPages).ToList();
+        }
+
+        var pages = new SortedSet<int> { 1, totalPages };
+        for (var p = currentPage - radius; p <= currentPage + radius; p++)
+        {
+            if (p >= 1 && p <= totalPages)
+            {
+                pages.Add(p);
+            }
+        }
+
+        // Walk the sorted set, inserting an ellipsis (0) wherever a gap exists.
+        var result = new List<int>();
+        var previous = 0;
+        foreach (var page in pages)
+        {
+            if (previous != 0 && page - previous > 1)
+            {
+                result.Add(0); // ellipsis
+            }
+            result.Add(page);
+            previous = page;
+        }
+        return result;
+    }
+}

src/ScadaLink.CentralUI/Components/Shared/TreeView.razor

@@ -126,29 +126,56 @@ else
         if (_contextMenuNeedsFocus && _showContextMenu)
         {
             _contextMenuNeedsFocus = false;
-            try { await _contextMenuRef.FocusAsync(); } catch { /* element may have been disposed if dismissed during render */ }
+            // The context-menu element may have been removed (menu dismissed
+            // during render) or the circuit disconnected — both are expected.
+            try { await _contextMenuRef.FocusAsync(); }
+            catch (Microsoft.JSInterop.JSException) { }
+            catch (Microsoft.JSInterop.JSDisconnectedException) { }
+            catch (InvalidOperationException) { }
         }
 
         if (firstRender && StorageKey != null)
         {
-            var json = await JSRuntime.InvokeAsync<string?>("treeviewStorage.load", StorageKey);
+            string? json = null;
+            try
+            {
+                json = await JSRuntime.InvokeAsync<string?>("treeviewStorage.load", StorageKey);
+            }
+            catch (Microsoft.JSInterop.JSDisconnectedException)
+            {
+                // Circuit disconnected before the storage read completed — there
+                // is nothing to restore and nothing to log.
+            }
             _storageLoaded = true;
 
+            // CentralUI-018: a corrupt or wrong-shaped treeviewStorage payload
+            // must not throw out of OnAfterRenderAsync. Guard the deserialize
+            // and treat an unparseable payload as "no prior state".
+            List<string>? keys = null;
             if (json != null)
             {
-                var keys = System.Text.Json.JsonSerializer.Deserialize<List<string>>(json);
+                try
-                if (keys != null)
                 {
-                    // Union (don't replace): callers may have invoked RevealNode before
+                    keys = System.Text.Json.JsonSerializer.Deserialize<List<string>>(json);
-                    // this async storage load completed. Preserving those reveal-added
-                    // keys ensures deep-link reveal isn't clobbered by the restore.
-                    foreach (var k in keys) _expandedKeys.Add(k);
-                    _initialExpansionApplied = true;
                 }
+                catch (System.Text.Json.JsonException)
+                {
+                    keys = null;
+                }
+            }
+
+            if (keys != null)
+            {
+                // Union (don't replace): callers may have invoked RevealNode before
+                // this async storage load completed. Preserving those reveal-added
+                // keys ensures deep-link reveal isn't clobbered by the restore.
+                foreach (var k in keys) _expandedKeys.Add(k);
+                _initialExpansionApplied = true;
             }
             else if (InitiallyExpanded != null && _items is { Count: > 0 } && !_initialExpansionApplied)
             {
-                // Storage returned null (no prior state) — fall back to InitiallyExpanded
+                // Storage returned null or a corrupt payload (no usable prior
+                // state) — fall back to InitiallyExpanded.
                 _initialExpansionApplied = true;
                 ApplyInitialExpansion(_items);
             }

src/ScadaLink.CentralUI/_Imports.razor

@@ -4,6 +4,7 @@
 @using Microsoft.AspNetCore.Components.Forms
 @using Microsoft.AspNetCore.Components.Routing
 @using Microsoft.AspNetCore.Components.Web
+@using Microsoft.Extensions.Logging
 @using Microsoft.JSInterop
 @using static Microsoft.AspNetCore.Components.Web.RenderMode
 @using ScadaLink.CentralUI

tests/ScadaLink.CentralUI.Tests/Auth/AuthEndpointsCsrfTests.cs

@@ -0,0 +1,76 @@
+using Microsoft.AspNetCore.Antiforgery;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Routing;
+using Microsoft.Extensions.DependencyInjection;
+using ScadaLink.CentralUI.Auth;
+
+namespace ScadaLink.CentralUI.Tests.Auth;
+
+/// <summary>
+/// Regression tests for CentralUI-017. <c>POST /auth/logout</c> called
+/// <c>.DisableAntiforgery()</c> and a plain <c>GET /logout</c> route also
+/// signed the user out — either could be triggered cross-site to forcibly log
+/// a user out. Logout is a state-changing authenticated action and must be
+/// CSRF-protected: the POST keeps antiforgery enabled and the state-changing
+/// GET route is removed.
+/// </summary>
+public class AuthEndpointsCsrfTests
+{
+    private static IReadOnlyList<RouteEndpoint> BuildEndpoints()
+    {
+        var builder = WebApplication.CreateBuilder();
+        builder.Services.AddRouting();
+        builder.Services.AddAntiforgery();
+        var app = builder.Build();
+        app.MapAuthEndpoints();
+
+        return ((IEndpointRouteBuilder)app).DataSources
+            .SelectMany(ds => ds.Endpoints)
+            .OfType<RouteEndpoint>()
+            .ToList();
+    }
+
+    private static RouteEndpoint? Find(IReadOnlyList<RouteEndpoint> endpoints, string pattern, string method)
+        => endpoints.FirstOrDefault(e =>
+            e.RoutePattern.RawText == pattern &&
+            (e.Metadata.GetMetadata<HttpMethodMetadata>()?.HttpMethods.Contains(method) ?? false));
+
+    [Fact]
+    public void PostAuthLogout_DoesNotDisableAntiforgery()
+    {
+        var endpoints = BuildEndpoints();
+        var logout = Find(endpoints, "/auth/logout", "POST");
+
+        Assert.NotNull(logout);
+        // DisableAntiforgery() leaves an IAntiforgeryMetadata with
+        // RequiresValidation == false. A CSRF-protected POST has either no such
+        // metadata, or metadata that still requires validation.
+        var antiforgery = logout!.Metadata.GetMetadata<IAntiforgeryMetadata>();
+        Assert.True(antiforgery is null || antiforgery.RequiresValidation,
+            "POST /auth/logout must keep antiforgery validation enabled.");
+    }
+
+    [Fact]
+    public void GetLogout_StateChangingRoute_IsRemoved()
+    {
+        var endpoints = BuildEndpoints();
+        var getLogout = Find(endpoints, "/logout", "GET");
+
+        Assert.Null(getLogout);
+    }
+
+    [Fact]
+    public void PostAuthLogin_StillDisablesAntiforgery_PreAuthIsAcceptable()
+    {
+        // Login is a pre-auth endpoint; disabling antiforgery there is acceptable
+        // and intentional. This pins that the fix did not over-correct.
+        var endpoints = BuildEndpoints();
+        var login = Find(endpoints, "/auth/login", "POST");
+
+        Assert.NotNull(login);
+        var antiforgery = login!.Metadata.GetMetadata<IAntiforgeryMetadata>();
+        Assert.NotNull(antiforgery);
+        Assert.False(antiforgery!.RequiresValidation);
+    }
+}

tests/ScadaLink.CentralUI.Tests/Shared/DataTablePagerTests.cs

@@ -0,0 +1,68 @@
+using Bunit;
+using Microsoft.AspNetCore.Components;
+using ScadaLink.CentralUI.Components.Shared;
+
+namespace ScadaLink.CentralUI.Tests.Shared;
+
+/// <summary>
+/// Regression tests for CentralUI-016. <c>DataTable</c> looped
+/// <c>for i = 1..totalPages</c> and emitted one numbered <c>&lt;li&gt;</c>
+/// button per page; a few thousand records at page size 25 rendered hundreds
+/// of buttons into the diff on every state change. The fix windows the pager
+/// so only first / last / a small range around the current page render.
+/// </summary>
+public class DataTablePagerTests : BunitContext
+{
+    private IRenderedComponent<DataTable<int>> RenderTable(int itemCount, int pageSize = 25)
+    {
+        return Render<DataTable<int>>(parameters => parameters
+            .Add(p => p.Items, Enumerable.Range(1, itemCount).ToList())
+            .Add(p => p.PageSize, pageSize)
+            .Add(p => p.ShowSearch, false)
+            .Add(p => p.HeaderContent, (RenderFragment)(b => b.AddMarkupContent(0, "<th>N</th>")))
+            .Add(p => p.RowContent, (RenderFragment<int>)(item => b => b.AddMarkupContent(0, $"<tr><td>{item}</td></tr>"))));
+    }
+
+    private static int NumberedPageButtons(IRenderedComponent<DataTable<int>> cut)
+        => cut.FindAll("ul.pagination li.page-item button")
+              .Count(b => int.TryParse(b.TextContent.Trim(), out _));
+
+    [Fact]
+    public void Pager_WithThousandsOfPages_RendersWindowedNotEveryPage()
+    {
+        // 5000 items / 25 = 200 pages. The pre-fix pager rendered 200 numbered
+        // buttons; the windowed pager renders at most a dozen.
+        var cut = RenderTable(itemCount: 5000);
+
+        var numbered = NumberedPageButtons(cut);
+
+        Assert.True(numbered <= 12,
+            $"Expected a windowed pager (<= 12 numbered buttons) but rendered {numbered}.");
+    }
+
+    [Fact]
+    public void Pager_SmallDataset_StillRendersEveryPage()
+    {
+        // 5 pages — small enough to render all numbered buttons (no windowing harm).
+        var cut = RenderTable(itemCount: 125);
+
+        var numbered = NumberedPageButtons(cut);
+
+        Assert.Equal(5, numbered);
+    }
+
+    [Fact]
+    public void Pager_WindowedAroundCurrentPage_AlwaysIncludesFirstAndLast()
+    {
+        var cut = RenderTable(itemCount: 5000); // 200 pages
+
+        var numbered = cut.FindAll("ul.pagination li.page-item button")
+            .Select(b => b.TextContent.Trim())
+            .Where(t => int.TryParse(t, out _))
+            .ToList();
+
+        // First and last page are always reachable from the windowed pager.
+        Assert.Contains("1", numbered);
+        Assert.Contains("200", numbered);
+    }
+}

tests/ScadaLink.CentralUI.Tests/Shared/DialogServiceThreadingTests.cs

@@ -0,0 +1,117 @@
+using ScadaLink.CentralUI.Components.Shared;
+
+namespace ScadaLink.CentralUI.Tests.Shared;
+
+/// <summary>
+/// Characterization tests for CentralUI-015 (re-triaged Won't Fix — see
+/// findings.md). The finding claimed <c>ContinueWith(..., TaskScheduler.Default)</c>
+/// made callers resume off the render thread; that premise is incorrect — an
+/// <c>await</c> always resumes on the awaiter's own captured
+/// <see cref="SynchronizationContext"/> regardless of where the awaited task
+/// completes. <c>ConfirmAsync_AwaiterResumesOnItsCapturedSyncContext</c> pins
+/// that correct behaviour (it passes against both the old <c>ContinueWith</c>
+/// form and the current inline-projection form). The remaining tests pin the
+/// dialog result-resolution contract.
+/// </summary>
+public class DialogServiceThreadingTests
+{
+    /// <summary>
+    /// A single-threaded sync context that records every posted callback —
+    /// stands in for the Blazor renderer's dispatcher.
+    /// </summary>
+    private sealed class TrackingSyncContext : SynchronizationContext
+    {
+        private readonly Thread _thread;
+        private readonly System.Collections.Concurrent.BlockingCollection<(SendOrPostCallback, object?)> _queue = new();
+        public int PostedCount;
+
+        public TrackingSyncContext()
+        {
+            _thread = new Thread(() =>
+            {
+                SetSynchronizationContext(this);
+                foreach (var (cb, st) in _queue.GetConsumingEnumerable())
+                {
+                    cb(st);
+                }
+            }) { IsBackground = true };
+            _thread.Start();
+        }
+
+        public override void Post(SendOrPostCallback d, object? state)
+        {
+            Interlocked.Increment(ref PostedCount);
+            _queue.Add((d, state));
+        }
+
+        public void Complete() => _queue.CompleteAdding();
+    }
+
+    [Fact]
+    public async Task ConfirmAsync_AwaiterResumesOnItsCapturedSyncContext()
+    {
+        var service = new DialogService();
+        var ctx = new TrackingSyncContext();
+
+        // Run the awaiting "component" code on the tracking context.
+        var done = new TaskCompletionSource<int>();
+        ctx.Post(async void (_) =>
+        {
+            try
+            {
+                var task = service.ConfirmAsync("t", "m");
+                // Resolve from another thread, mimicking the host dispatching.
+                _ = Task.Run(() => service.Resolve(true));
+                await task;
+                // The continuation after the await must be back on the tracking
+                // context's single thread.
+                done.SetResult(Environment.CurrentManagedThreadId);
+            }
+            catch (Exception ex)
+            {
+                done.SetException(ex);
+            }
+        }, null);
+
+        var resumeThreadId = await done.Task;
+        ctx.Complete();
+
+        // The continuation was posted to (and ran on) the captured context.
+        Assert.True(ctx.PostedCount >= 1,
+            "ConfirmAsync continuation must post back to the caller's SynchronizationContext.");
+        Assert.NotEqual(Environment.CurrentManagedThreadId, resumeThreadId);
+    }
+
+    [Fact]
+    public async Task ConfirmAsync_ResolvesWithExpectedValue()
+    {
+        var service = new DialogService();
+
+        var task = service.ConfirmAsync("t", "m");
+        service.Resolve(true);
+
+        Assert.True(await task);
+    }
+
+    [Fact]
+    public async Task PromptAsync_ResolvesWithExpectedValue()
+    {
+        var service = new DialogService();
+
+        var task = service.PromptAsync("t", "label");
+        service.Resolve("typed value");
+
+        Assert.Equal("typed value", await task);
+    }
+
+    [Fact]
+    public async Task PromptAsync_CancelledResolvesToNull()
+    {
+        var service = new DialogService();
+
+        var task = service.PromptAsync("t", "label");
+        service.Resolve(null);
+
+        Assert.Null(await task);
+    }
+}

tests/ScadaLink.CentralUI.Tests/Shared/MonacoEditorLoggingTests.cs

@@ -0,0 +1,77 @@
+using Bunit;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using Microsoft.JSInterop;
+using ScadaLink.CentralUI.Components.Shared;
+
+namespace ScadaLink.CentralUI.Tests.Shared;
+
+/// <summary>
+/// Regression tests for CentralUI-018. <c>MonacoEditor</c> wrapped every JS
+/// interop call in a bare <c>try { ... } catch { }</c> with no logging — a
+/// genuine Monaco init failure became invisible. The fix narrows the catch to
+/// the expected prerender / disconnect cases and logs any real
+/// <see cref="JSException"/> via <c>ILogger</c>.
+/// </summary>
+public class MonacoEditorLoggingTests : BunitContext
+{
+    /// <summary>Captures log entries so the test can assert on them.</summary>
+    private sealed class CapturingLoggerProvider : ILoggerProvider
+    {
+        public List<(LogLevel Level, string Message, Exception? Exception)> Entries { get; } = new();
+
+        public ILogger CreateLogger(string categoryName) => new CapturingLogger(Entries);
+        public void Dispose() { }
+
+        private sealed class CapturingLogger : ILogger
+        {
+            private readonly List<(LogLevel, string, Exception?)> _entries;
+            public CapturingLogger(List<(LogLevel, string, Exception?)> entries) => _entries = entries;
+
+            public IDisposable? BeginScope<TState>(TState state) where TState : notnull => null;
+            public bool IsEnabled(LogLevel logLevel) => true;
+
+            public void Log<TState>(LogLevel logLevel, EventId eventId, TState state,
+                Exception? exception, Func<TState, Exception?, string> formatter)
+                => _entries.Add((logLevel, formatter(state, exception), exception));
+        }
+    }
+
+    [Fact]
+    public void CreateEditor_GenuineJsException_IsLogged_NotSwallowed()
+    {
+        var provider = new CapturingLoggerProvider();
+        Services.AddLogging(b => b.AddProvider(provider));
+
+        // createEditor is an InvokeVoidAsync call — configure it to throw a
+        // genuine JSException so we exercise the real-failure path.
+        JSInterop.Mode = JSRuntimeMode.Strict;
+        JSInterop.SetupVoid("MonacoBlazor.createEditor", _ => true)
+            .SetException(new JSException("Monaco failed to load"));
+
+        // Pre-fix: the bare catch {} swallowed this with no trace. Post-fix:
+        // the component renders fine but the failure is logged.
+        var cut = Render<MonacoEditor>(p => p.Add(c => c.ShowToolbar, false));
+
+        var errors = provider.Entries.Where(e => e.Level == LogLevel.Error).ToList();
+        Assert.NotEmpty(errors);
+        Assert.Contains(errors, e => e.Exception is JSException);
+    }
+
+    [Fact]
+    public void CreateEditor_Prerender_DoesNotLog()
+    {
+        // When JS interop is unavailable (prerender), createEditor throws
+        // InvalidOperationException — that is expected and must NOT be logged.
+        var provider = new CapturingLoggerProvider();
+        Services.AddLogging(b => b.AddProvider(provider));
+
+        JSInterop.Mode = JSRuntimeMode.Strict;
+        JSInterop.SetupVoid("MonacoBlazor.createEditor", _ => true)
+            .SetException(new InvalidOperationException("JS interop not available during prerender"));
+
+        var cut = Render<MonacoEditor>(p => p.Add(c => c.ShowToolbar, false));
+
+        Assert.DoesNotContain(provider.Entries, e => e.Level >= LogLevel.Warning);
+    }
+}

tests/ScadaLink.CentralUI.Tests/Shared/PagerWindowTests.cs

@@ -0,0 +1,67 @@
+using ScadaLink.CentralUI.Components.Shared;
+
+namespace ScadaLink.CentralUI.Tests.Shared;
+
+/// <summary>
+/// Unit tests for the <see cref="PagerWindow"/> helper introduced for
+/// CentralUI-016 — windowed pagination that keeps the rendered button count
+/// bounded regardless of total page count.
+/// </summary>
+public class PagerWindowTests
+{
+    [Fact]
+    public void Build_SmallPageCount_ReturnsEveryPage_NoEllipsis()
+    {
+        var pages = PagerWindow.Build(currentPage: 3, totalPages: 5);
+
+        Assert.Equal(new[] { 1, 2, 3, 4, 5 }, pages);
+    }
+
+    [Fact]
+    public void Build_LargePageCount_IsBounded_AndIncludesFirstAndLast()
+    {
+        var pages = PagerWindow.Build(currentPage: 100, totalPages: 200);
+
+        Assert.Contains(1, pages);
+        Assert.Contains(200, pages);
+        Assert.Contains(100, pages);
+        // First, ellipsis, window of 5, ellipsis, last — never the full 200.
+        Assert.True(pages.Count <= 12, $"Expected a bounded window but got {pages.Count} entries.");
+    }
+
+    [Fact]
+    public void Build_LargePageCount_InsertsEllipsisForGaps()
+    {
+        // 0 is the ellipsis sentinel.
+        var pages = PagerWindow.Build(currentPage: 100, totalPages: 200);
+
+        Assert.Contains(0, pages);
+    }
+
+    [Fact]
+    public void Build_CurrentNearStart_NoLeadingEllipsis()
+    {
+        var pages = PagerWindow.Build(currentPage: 1, totalPages: 200);
+
+        // Pages 1..3 are contiguous from the start, so no ellipsis before them.
+        Assert.Equal(1, pages[0]);
+        Assert.NotEqual(0, pages[1]);
+    }
+
+    [Fact]
+    public void Build_ClampsOutOfRangeCurrentPage()
+    {
+        var pages = PagerWindow.Build(currentPage: 999, totalPages: 200);
+
+        Assert.Contains(200, pages);
+        Assert.True(pages.Count <= 12);
+    }
+
+    [Theory]
+    [InlineData(0)]
+    [InlineData(-3)]
+    public void Build_NonPositiveTotalPages_ReturnsEmpty(int totalPages)
+    {
+        Assert.Empty(PagerWindow.Build(currentPage: 1, totalPages: totalPages));
+    }
+}

tests/ScadaLink.CentralUI.Tests/Shared/TreeViewStorageResilienceTests.cs

@@ -0,0 +1,62 @@
+using Bunit;
+using Microsoft.AspNetCore.Components;
+using ScadaLink.CentralUI.Components.Shared;
+
+namespace ScadaLink.CentralUI.Tests.Shared;
+
+/// <summary>
+/// Regression tests for CentralUI-018. <c>TreeView</c>'s storage-restore path
+/// called <c>JsonSerializer.Deserialize</c> on the raw <c>treeviewStorage</c>
+/// payload outside any try block — a corrupt payload threw an uncaught
+/// <c>JsonException</c> during <c>OnAfterRenderAsync</c>, breaking the
+/// component. The fix guards the deserialize and ignores a corrupt payload.
+/// </summary>
+public class TreeViewStorageResilienceTests : BunitContext
+{
+    private record TestNode(string Key, string Label, List<TestNode> Children);
+
+    private static List<TestNode> Roots() => new()
+    {
+        new("a", "Alpha", new() { new("a1", "Alpha-1", new()) }),
+        new("b", "Beta", new()),
+    };
+
+    private IRenderedComponent<TreeView<TestNode>> BuildTree()
+        => Render<TreeView<TestNode>>(parameters => parameters
+            .Add(p => p.Items, Roots())
+            .Add(p => p.ChildrenSelector, n => n.Children)
+            .Add(p => p.HasChildrenSelector, n => n.Children.Count > 0)
+            .Add(p => p.KeySelector, n => n.Key)
+            .Add(p => p.NodeContent, (RenderFragment<TestNode>)(node => b =>
+                b.AddMarkupContent(0, $"<span>{node.Label}</span>")))
+            .Add(p => p.StorageKey, "corrupt-tree"));
+
+    [Fact]
+    public void StorageRestore_CorruptJsonPayload_DoesNotThrow_AndStillRenders()
+    {
+        // A garbage payload that is not valid JSON for a List<string>.
+        JSInterop.Setup<string?>("treeviewStorage.load", _ => true)
+            .SetResult("{not json at all]");
+        JSInterop.SetupVoid("treeviewStorage.save", _ => true);
+
+        // Pre-fix: OnAfterRenderAsync threw JsonException out of the unguarded
+        // Deserialize call. Post-fix: the corrupt payload is ignored.
+        var cut = BuildTree();
+
+        Assert.Contains("Alpha", cut.Markup);
+        Assert.Contains("Beta", cut.Markup);
+    }
+
+    [Fact]
+    public void StorageRestore_WrongShapeJson_DoesNotThrow()
+    {
+        // Valid JSON, but not a List<string> — an object, not an array.
+        JSInterop.Setup<string?>("treeviewStorage.load", _ => true)
+            .SetResult("{\"unexpected\": true}");
+        JSInterop.SetupVoid("treeviewStorage.save", _ => true);
+
+        var cut = BuildTree();
+
+        Assert.Contains("Alpha", cut.Markup);
+    }
+}

tests/ScadaLink.CentralUI.Tests/TopologyPageTests.cs

@@ -54,6 +54,9 @@ public class TopologyPageTests : BunitContext
             OperationLockTimeout = TimeSpan.FromSeconds(5)
         }));
         Services.AddSingleton<ILogger<DeploymentService>>(NullLogger<DeploymentService>.Instance);
+        // DeploymentService gained a DiffService dependency (DeploymentManager
+        // contract change); register it so the page's DI graph resolves.
+        Services.AddScoped<ScadaLink.TemplateEngine.Flattening.DiffService>();
         Services.AddScoped<DeploymentService>();
         Services.AddScoped<AreaService>();
         Services.AddScoped<InstanceService>();