Joseph Doherty
3e3748b985
Adds the end-to-end layer the unit suites structurally cannot reach: a real
in-process ASP.NET Core host serving SecretsHubService through
AddZbSecretsGrpcHub/MapZbSecretsHub, a follower built by the shipped
AddZbSecretsGrpcHubClient, a real gRPC call between them, and real SQLite
stores on both sides. The class of defect this catches is pieces that are each
individually correct and are never connected to one another — for instance the
interceptor's warn-once, which only holds if the container really hands gRPC
the singleton it registered.
Covered: byte-identical convergence over the wire (every ciphertext/nonce/tag/
wrapped-DEK byte, kek_id, revision, both timestamps INCLUDING their offsets,
across a tombstone, a nulls-everywhere row and an empty-string-description row);
delete propagation; a hub unreachable at follower boot leaving the last-known-
good store intact and converging once it answers; the auth negatives fail-closed
across the wire with one uniform denial detail; the per-request name cap as
ResourceExhausted; and an RpcException from the call invoker escaping the hub
client unchanged, so a transport fault stays distinguishable from a parse fault.
The credential-hygiene assertions are made against logs captured at Trace on
BOTH hosts, so "no token material ever reaches a sink" is asserted at the most
verbose setting a deployment could switch on.
SecretsHubContractPinTests reads the generated descriptor — not the .proto text
— and pins the RPC set to exactly {GetManifest, GetSecrets}, plus unary-only and
the package-qualified service name. The hub is pull-only by construction:
updates originate at central only, and the absence of a write RPC is what
enforces that, not authorization a mis-wired follower may hold more of than
intended. A third RPC silently retires the guarantee, so the failure message
says so.
Microsoft.AspNetCore.TestHost pinned at 10.0.7 — the version ZB.MOM.WW.LocalDb,
OtOpcUa and ScadaBridge already pin, matching the Microsoft.Extensions.* line.
Full suite: 436 passed / 0 failed / 15 skipped, no new warnings.
Claude-Session: https://claude.ai/code/session_014WNM4vjoVksyyBraTXSZE1
90 lines
5.2 KiB
XML
90 lines
5.2 KiB
XML
<Project>
|
|
|
|
<PropertyGroup>
|
|
<ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
|
|
<!-- Enable transitive pinning so the security override below (SQLitePCLRaw native lib) takes effect. -->
|
|
<CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
|
|
</PropertyGroup>
|
|
|
|
<ItemGroup>
|
|
<!-- LDAP -->
|
|
<PackageVersion Include="Novell.Directory.Ldap.NETStandard" Version="3.6.0" />
|
|
|
|
<!-- Data -->
|
|
<PackageVersion Include="Microsoft.Data.Sqlite" Version="10.0.7" />
|
|
<!-- Transitive security pin: Microsoft.Data.Sqlite 10.0.7 pulls SQLitePCLRaw.lib.e_sqlite3 2.1.11,
|
|
which carries advisory GHSA-2m69-gcr7-jv3q (NU1903). Pin the patched 2.1.12 native lib. -->
|
|
<PackageVersion Include="SQLitePCLRaw.lib.e_sqlite3" Version="2.1.12" />
|
|
|
|
<!-- Shared SQL-Server secret store (ZB.MOM.WW.Secrets.Replication.SqlServer).
|
|
6.0.2 matches the version ScadaBridge and ZB.MOM.WW.GalaxyRepository already resolve, so a
|
|
consumer taking both gets one SqlClient rather than a downgrade warning. -->
|
|
<PackageVersion Include="Microsoft.Data.SqlClient" Version="6.0.2" />
|
|
|
|
<!-- Akka cluster replication (ZB.MOM.WW.Secrets.Replication.Akka).
|
|
1.5.62 matches ScadaBridge's pinned Akka.NET line — the clustered consumer must not be
|
|
forced into an Akka version bump just to adopt secret replication. -->
|
|
<PackageVersion Include="Akka" Version="1.5.62" />
|
|
<PackageVersion Include="Akka.Cluster" Version="1.5.62" />
|
|
<PackageVersion Include="Akka.Cluster.Tools" Version="1.5.62" />
|
|
<PackageVersion Include="Akka.Remote" Version="1.5.62" />
|
|
<PackageVersion Include="Akka.TestKit.Xunit2" Version="1.5.62" />
|
|
|
|
<!-- gRPC secrets hub (ZB.MOM.WW.Secrets.Replicator.Grpc).
|
|
2.76.0 / 3.34.1 is the version the whole family already resolves — ScadaBridge and
|
|
OtOpcUa pin exactly these, and the sibling ZB.MOM.WW.LocalDb libraries floor them there.
|
|
A consumer taking the hub alongside LocalDb replication must not be pushed into a
|
|
downgrade warning or an unplanned Grpc bump just to adopt secret replication. -->
|
|
<PackageVersion Include="Google.Protobuf" Version="3.34.1" />
|
|
<PackageVersion Include="Grpc.AspNetCore" Version="2.76.0" />
|
|
<PackageVersion Include="Grpc.Core.Api" Version="2.76.0" />
|
|
<PackageVersion Include="Grpc.Net.Client" Version="2.76.0" />
|
|
<PackageVersion Include="Grpc.Tools" Version="2.76.0" />
|
|
|
|
<!-- Cryptography -->
|
|
<!-- 9.0.4, not 9.0.0: Microsoft.Data.SqlClient 6.0.2 pulls System.Configuration.ConfigurationManager
|
|
9.0.4, which requires ProtectedData >= 9.0.4. With transitive pinning on, the lower central
|
|
version is a hard NU1109 downgrade error rather than a silent resolve. -->
|
|
<PackageVersion Include="System.Security.Cryptography.ProtectedData" Version="9.0.4" />
|
|
|
|
<!-- Extensions -->
|
|
<PackageVersion Include="Microsoft.Extensions.Options" Version="10.0.7" />
|
|
<PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="10.0.7" />
|
|
<PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.7" />
|
|
<PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.7" />
|
|
<PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.7" />
|
|
<PackageVersion Include="Microsoft.Extensions.Configuration" Version="10.0.7" />
|
|
<PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.7" />
|
|
<PackageVersion Include="Microsoft.Extensions.Hosting" Version="10.0.7" />
|
|
<PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.7" />
|
|
<PackageVersion Include="Microsoft.Extensions.Logging" Version="10.0.7" />
|
|
|
|
<!-- ASP.NET Core Authentication / Authorization -->
|
|
<PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.7" />
|
|
<PackageVersion Include="Microsoft.AspNetCore.Authorization" Version="10.0.7" />
|
|
|
|
<!-- ZB.MOM.WW shared libraries (Gitea feed) -->
|
|
<PackageVersion Include="ZB.MOM.WW.Audit" Version="0.1.0" />
|
|
<PackageVersion Include="ZB.MOM.WW.Theme" Version="0.2.0" />
|
|
<PackageVersion Include="ZB.MOM.WW.Auth.AspNetCore" Version="0.1.4" />
|
|
|
|
<!-- Interactive console -->
|
|
<PackageVersion Include="Spectre.Console" Version="0.50.0" />
|
|
<PackageVersion Include="Spectre.Console.Testing" Version="0.50.0" />
|
|
|
|
<!-- Test -->
|
|
<PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
|
|
<PackageVersion Include="xunit" Version="2.9.3" />
|
|
<PackageVersion Include="xunit.runner.visualstudio" Version="3.1.4" />
|
|
<PackageVersion Include="Xunit.SkippableFact" Version="1.5.61" />
|
|
<!-- In-process ASP.NET Core host for the gRPC secrets-hub end-to-end suite. 10.0.7 is the
|
|
version the rest of the family already pins (ZB.MOM.WW.LocalDb, OtOpcUa, ScadaBridge) and
|
|
matches the Microsoft.Extensions.* line above, so the test host cannot drag a second
|
|
ASP.NET Core version into the graph. -->
|
|
<PackageVersion Include="Microsoft.AspNetCore.TestHost" Version="10.0.7" />
|
|
<PackageVersion Include="coverlet.collector" Version="6.0.4" />
|
|
<PackageVersion Include="bunit" Version="1.40.0" />
|
|
</ItemGroup>
|
|
|
|
</Project>
|