Sarand/Common-VS2019
1
1
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Extract paired business object projects

Browse Source
This commit is contained in:
Andy Howard
2026-10-06 17:48:37 +01:00
parent 5daf7ce97f
commit d3c5ceaf7a
170 changed files with 168 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/component-reviews.md
+2 -1
View File
@@ -7,10 +7,11 @@ table td {
}
</style>
Last updated: 2026-09-16
Last updated: 2026-10-06
| Component | Scope | Status | Date reviewed | Next steps | Notes |
|---|---|---|---|---|---|
| `SacsBusinessBase` and `SacsBusinessDbas` | Paired business object project extraction | Implemented; Common and BusinessMgr builds and unit tests pass | 2026-10-06 | Include these projects in downstream builds when consumers retarget to Common's current framework. | Moved `CodeTypes`, `Diary`, `Interfaces`, `ItemData`, `ItemDocs`, `ItemOptions`, `ReferenceData`, `Security`, and `UpdateLog` with their complete folder contents. Both projects target `net10.0` and retain root namespace `Sarand.Net.Standard`. `SacsDatabaseOdbc` now uses `DbUtil.DelimitReservedWord`, which removes the StandardDbas dependency on Base business code. BusinessMgr project references were updated. Common and BusinessMgr Debug builds pass; Common unit tests pass 185/185, BusinessMgr Control passes 15/15, and Portal passes 13/13. Sandalwood's Windows build succeeds. Sandtrap's Windows build reports a missing `SamThreadUtil.InvokeOnMainThread` API, outside the extracted code. The new database project package audit reports no vulnerable packages. Assembly identity changed, so consumers require rebuilt references. Saxonite remains outside this migration: its projects target `net6.0` while the shared Common libraries target `net10.0`. |
| `SacsStandardBase/Base/Utils/AssemblyUtil.cs` | PE/COFF timestamp utility | Hardened and covered | 2026-09-16 | Retain the focused tests; use the non-throwing `TryGetBuildDateTime` API where an unavailable timestamp must be distinguished from `DateTime.MinValue`. | Exact primitive reads replace unchecked partial reads and marshaling. Five tests cover a known timestamp, invalid signature, truncated input, a loaded assembly, and null input. COFF timestamps are not presented as reliable physical build times for deterministic builds. Existing framework APIs already cover assembly identity, version, and metadata, so no duplicate convenience wrappers were added. |
| `SaCommonVS.sln` | .NET 10 migration build and tests | Migration complete; passing with warnings | 2026-09-16 | Continue the staged package review with the remaining framework-aligned and separately tested major updates. | All supported projects target .NET 10 only. The completed package and utility updates pass the complete validation. The solution builds with zero errors and all 185 tests pass; BusinessMgr builds with 15 Control and 13 Portal tests passing. Xamarin remains isolated and unchanged. |
| `SacsStandardBase/Base/Utils/ImageUtils.cs` | ImageSharp wrapper | Covered; package retained pending later functional review | 2026-09-16 | Leave ImageSharp 3.1.12 unchanged and revisit raster handling, licensing, and alternatives separately. | Five in-memory tests cover PNG and JPEG metadata, invalid and truncated input, SVG recognition, format-preserving encoding, proportional landscape and portrait resizing, no-upscale behavior, and invalid constraints. Later options are to license and upgrade to ImageSharp 4.1.2, retain a secure 3.x release, migrate to MIT-licensed SkiaSharp with its native assets and wrapper rewrite, or evaluate Magick.NET/ImageMagick for its broad format and processing support while accounting for native binaries and a heavier dependency footprint. This raster concern is distinct from BusinessMgr's Windows-only report printing. |
docs/topics.md
+3 -1
View File
@@ -7,7 +7,7 @@ table td {
}
</style>
Last updated: 2026-09-16
Last updated: 2026-10-06
## Prioritised Topics to Be Actioned
@@ -16,6 +16,7 @@ Last updated: 2026-09-16
| P2 | Externalise and rotate encryption keys | 2026-09-16 | Move the retained in-code application keys to protected configuration or a secret store, then add key identifiers and a rotation policy in a separately scoped change. | The agreed clean-break AES-GCM migration is complete and intentionally retains the existing key strings. This follow-up is defense-in-depth and requires an operational key-deployment decision. |
| P3 | Review raster image handling and ImageSharp | 2026-09-16 | Retain ImageSharp 3.1.12 for now and revisit the wrapper, licensing, and alternatives as a separately scoped functional review. | Version 3.1.12 has no reported vulnerability and five focused tests cover the current narrow use. Later options are: obtain an eligible free or commercial licence and upgrade to ImageSharp 4.1.2; retain a supported secure 3.x release; migrate to MIT-licensed SkiaSharp, accepting native runtime assets and a wrapper rewrite; or evaluate Magick.NET/ImageMagick as a candidate with broad image-format and processing support but native binaries and a heavier dependency footprint. This review is separate from BusinessMgr's Windows printer integration. |
| P3 | Define disposal and cross-thread status semantics | 2026-09-09 | Decide whether to add asynchronous disposal and a synchronized process-status snapshot. | Disposal currently requests cancellation without awaiting termination; several status properties are read across threads. |
| P3 | Review duplicated reserved-word delimiting logic | 2026-10-06 | Compare the `DbDfn` implementations, generated output, and `DbUtil` helper; decide whether to centralise the logic while preserving each caller's reserved-word list and configurable delimiter behavior. | Eight business database-definition classes duplicate equivalent logic. `DbUtil.DelimitReservedWord` uses a separate word list and fixed square brackets, so it is not a drop-in equivalent. |
## Project-Specific Trackers
@@ -40,6 +41,7 @@ Last updated: 2026-09-16
| Topic | Date noted | Date started | Date completed | Outcome |
|---|---|---|---|---|
| Extract paired business object projects | 2026-10-06 | 2026-10-06 | 2026-10-06 | Created `SacsBusinessBase` and `SacsBusinessDbas` and moved the complete `CodeTypes`, `Diary`, `Interfaces`, `ItemData`, `ItemDocs`, `ItemOptions`, `ReferenceData`, `Security`, and `UpdateLog` folders. Preserved namespaces and `net10.0`; added project references to Common's CodeTypes consumer and all BusinessMgr projects that referenced the original libraries. Moved reserved-word handling to `DbUtil` to remove the StandardDbas-to-Security dependency. Common and BusinessMgr Debug builds pass; Common unit tests pass 185/185, BusinessMgr Control passes 15/15, and Portal passes 13/13. The new database project package audit reports no vulnerable packages. Sandalwood's Windows build passes. Sandtrap's Windows build still fails on `SamThreadUtil.InvokeOnMainThread`, outside this extraction. |
| Complete primary `SaProcess_Base` lifecycle protections | 2026-09-08 | 2026-09-08 | 2026-09-17 | A single lifecycle guard now rejects overlapping inline and asynchronous starts in either direction. A read-only interruption record preserves the first reason (manual request, cancellation request, or `OperationCanceledException`) until the next run resets it. `StopProcessAsync` now selects token cancellation for an asynchronous worker or a manual interruption request for an inline worker, then awaits completion. Cancellation is retained after asynchronous task-data cleanup, `OperationCanceledException` becomes cancellation rather than an error, and the async worker always runs its cleanup even if cancellation occurs before its delegate begins. Twelve focused tests cover successful execution, both overlap directions, pre-start cancellation, both stop modes, timeout retention, interruption reasons, cooperative cancellation, cancellation exceptions, and callback lock safety. No production `RunAsync()` call sites were found across Common, BusinessMgr, Sandtrap, or Sandalwood. Deferred work is limited to disposal/status semantics and derived-process cooperative polling. |
| Replace legacy CBC encryption with authenticated encryption | 2026-09-08 | 2026-09-16 | 2026-09-16 | Implemented the `SACSENC2.` AES-GCM envelope with fresh nonces, 16-byte authentication tags, and purpose-bound associated data. Removed active CBC, fixed/session IVs, legacy reads, and plaintext fallback. Retained existing in-code keys by explicit decision. Thirty focused Common tests and BusinessMgr consumer tests cover the new behavior; see [`authenticated-encryption-migration.md`](authenticated-encryption-migration.md). |
| Remove the obsolete PBKDF2 usage and establish encryption compatibility coverage | 2026-09-10 | 2026-09-16 | 2026-09-16 | Replaced the obsolete `Rfc2898DeriveBytes` constructor with static `Pbkdf2` using the same password, fixed salt, 300 iterations, SHA-256, and key length. Fixed legacy ciphertext proved derived-key and stored-data compatibility before the subsequent clean-break authenticated-encryption migration replaced that legacy format. Expanded direct coverage across both encryption helpers, corrected whitespace-only key acceptance, and disposed AES and transform resources. |