Review #15 P3 batch: LocalDb (005–007) and Auth (008–010) #46

New Issue

2026-11-09T14:39:44-05:00

dohertj2 commented

2026-11-09 14:39:44 -05:00

P3 findings from the scadaproj#15 shared-library review (verified at 91fb2b4) — full description, failure scenario and fix for each in code-reviews/<Lib>/findings.md. Split out any that grow.

LocalDb-005 — AUTOINCREMENT keys collide between nodes (one row silently lost)
LocalDb-006 — a column name containing ' breaks the sync SQL
LocalDb-007 — README out of date (version; baselining one table resyncs all)
Auth-008 — SQL Server key store truncates long key ids to 64 chars; case-insensitive key-id collisions on import
Auth-009 — username taken from the first value of a multi-valued attribute
Auth-010 — ApiKeyVerifier lets store exceptions escape (SQL down → 500, attempt unaudited)

P3 findings from the scadaproj#15 shared-library review (verified at 91fb2b4) — full description, failure scenario and fix for each in `code-reviews/<Lib>/findings.md`. Split out any that grow. - [ ] LocalDb-005 — AUTOINCREMENT keys collide between nodes (one row silently lost) - [ ] LocalDb-006 — a column name containing ' breaks the sync SQL - [ ] LocalDb-007 — README out of date (version; baselining one table resyncs all) - [ ] Auth-008 — SQL Server key store truncates long key ids to 64 chars; case-insensitive key-id collisions on import - [ ] Auth-009 — username taken from the first value of a multi-valued attribute - [ ] Auth-010 — ApiKeyVerifier lets store exceptions escape (SQL down → 500, attempt unaudited)

dohertj2 added the type:review-finding priority:p3 labels 2026-11-09 14:39:44 -05:00

dohertj2 commented

2026-11-09 15:26:48 -05:00

Fixed on main: LocalDb-005 (fd46999) RegisterReplicated refuses AUTOINCREMENT keys (reproduced: both nodes ended with only '1:from B'); plain INTEGER PRIMARY KEY still accepted, cross-node key uniqueness documented — ScadaBridge's 12 and OtOpcUa's 5 replicated tables use text/composite keys, unaffected. LocalDb-006 (76e9c35) one shared JsonPathSql escaping helper for apply + snapshot (2-node tests failed with 'near "key": syntax error'). LocalDb-007 (b9a096c) README refreshed. Auth-008 (b33f0f9) no schema change: over-length key records throw, >64-char ids return not-found without querying, exact key-id matching, importer reports KeyIdCollisions/KeysRejected (SQL Server suite 101/101 live). Auth-009 (9ec0da1) username = the attribute value matching what was typed. Auth-010 (c436653) new ApiKeyFailure.StoreUnavailable (appended); only cancellation throws. Consumer changes: AUTOINCREMENT tables now refused at registration; SQL Server key ids case-exact; over-length key creation throws; ApiKeyImportResult gains two lists. Evidence: LocalDb 249/249; Auth 363 passed / 81 skipped offline and 440 / 4 LDAP-live skips against a throwaway SQL Server 2022; each new regression test fails without its fix; findings 0 open, README --check consistent. Ships in LocalDb 0.3.6 / Auth 0.4.4 (unpublished).

Fixed on main: LocalDb-005 (fd46999) RegisterReplicated refuses AUTOINCREMENT keys (reproduced: both nodes ended with only '1:from B'); plain INTEGER PRIMARY KEY still accepted, cross-node key uniqueness documented — ScadaBridge's 12 and OtOpcUa's 5 replicated tables use text/composite keys, unaffected. LocalDb-006 (76e9c35) one shared JsonPathSql escaping helper for apply + snapshot (2-node tests failed with 'near "key": syntax error'). LocalDb-007 (b9a096c) README refreshed. Auth-008 (b33f0f9) no schema change: over-length key records throw, >64-char ids return not-found without querying, exact key-id matching, importer reports KeyIdCollisions/KeysRejected (SQL Server suite 101/101 live). Auth-009 (9ec0da1) username = the attribute value matching what was typed. Auth-010 (c436653) new ApiKeyFailure.StoreUnavailable (appended); only cancellation throws. **Consumer changes:** AUTOINCREMENT tables now refused at registration; SQL Server key ids case-exact; over-length key creation throws; ApiKeyImportResult gains two lists. Evidence: LocalDb 249/249; Auth 363 passed / 81 skipped offline and 440 / 4 LDAP-live skips against a throwaway SQL Server 2022; each new regression test fails without its fix; findings 0 open, README --check consistent. Ships in LocalDb 0.3.6 / Auth 0.4.4 (unpublished).

dohertj2 closed this issue

2026-11-09 15:26:49 -05:00

dohertj2 referenced this issue

2026-11-12 14:08:40 -05:00

[LocalDb] Publish 0.3.7 and adopt in ScadaBridge + OtOpcUa (tombstone fix #16) #53

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: dohertj2/scadaproj#46