fix: end DS activation race that broke system-realm auth at startup (#1882)

[craigpnnl]

Problem

The GridAPPS-D develop tag failed to start nondeterministically (machine and startup-path dependent), reported in GRIDAPPSD/GOSS-GridAPPS-D#1882. On the failing path, goss-core-server died during OSGi Declarative Services activation:

ERROR pnnl.goss.core.server.impl.GridOpticsServer - The start method has thrown an exception
com.northconcepts.exception.SystemException: Realm [UnauthTokenBasedRealm] was unable to
find account data for the submitted AuthenticationToken [UsernamePasswordToken - system]
    at GridOpticsServer.start(GridOpticsServer.java:448)

Root cause

The DependencyManager to Declarative Services migration left the Shiro realm set populated asynchronously by two racing binders. GridOpticsServer.start() (@activate) opens the broker and immediately authenticates createConnection("system", "manager"). The AT_LEAST_ONE cardinality guard only ensured some realm was bound, not the system-authenticating one. When the broker authenticated system before SystemBasedRealm was in the set, only UnauthTokenBasedRealm answered, returned null (by design), and startup died.

Fix

• Mark SystemBasedRealm with a realm.type=system service property.
• Add a mandatory, target-filtered @Reference(target="(realm.type=system)") to both the SecurityManager component (Activator, gating service publication) and GridOpticsServer (gating @Activate/broker-connect). Declarative Services now holds activation until the system-authenticating realm is bound.
• Collapse the realm-set write to a single owner: SecurityManagerRealmHandler no longer calls setRealms(), so a partial write can no longer transiently drop the system realm.
• The filter lives as a shared compile-time constant on GossRealm.

UnauthTokenBasedRealm returning null for system is intentional and unchanged. The fix is ordering only: no client credential or permission contract changes.

Testing

SystemRealmActivationOrderTest (7 cases): behavioral (system auth fails with only a non-system realm wired, succeeds once the system realm binds, * permission survives a later binding) plus DS-descriptor contract assertions (property/target present, handler no longer references the SecurityManager). ./gradlew :pnnl.goss.core:build is green.

Coverage note: true multi-bundle container activation ordering is not unit-testable here (no Pax Exam configured). The tests assert the wiring/auth invariants the container ordering depends on; a live Felix boot on the affected machine confirms end-to-end sequencing.

Reviews

Reviewed for code quality and security (fail-closed confirmed, no fail-open window, no dropped realm).

Related

• Symptom report: Error starting develop tag GRIDAPPSD/GOSS-GridAPPS-D#1882
• Tracking: GOSS-Core: fix develop-tag startup activation-order race (GRIDAPPSD/GOSS-GridAPPS-D#1882) + follow-ups #40
• Closes spotless: trailing whitespace in UnauthTokenBasedRealm.java:113 #41 (pre-existing spotless violation, folded in so branch CI is green)
• Follow-ups filed: GridOpticsServer discards configured manager credential (:221-224), hardcoded system/manager always used (:447) #42 (GridOpticsServer discards configured manager credential), Document hard config dependency: absent systemrealm.cfg hangs startup (fail-closed) after activation-order fix #43 (document config-absent startup-hang behavior)