<fix>[securitygroup]: remove strict sequential priority restriction

[MatheMatrix]

Resolves: ZSTAC-79067\n\nRemove overly strict sequential priority validation for security group rules API.

sync from gitlab !9173

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

放宽安全组规则优先级验证为仅要求正整数并保留全局上限，并发与稳定性改进（管理节点/调度/资源目的地同步化）、若干存储/网络/VM细节修正、测试用例调整以匹配新优先级行为，以及新增错误码与数据脱敏逻辑。

Changes

Cohort / File(s)	Summary
安全组 API 验证逻辑 plugin/securityGroup/src/main/java/org/zstack/network/securitygroup/SecurityGroupApiInterceptor.java	移除“从1开始且连续”校验，改为仅检查优先级为正整数（>=1）并保留对全局最大值的检查，更新错误提示。
相关测试用例 test/src/test/groovy/.../securitygroup/AddSecurityGroupRuleOptimizedCase.groovy, test/src/test/groovy/.../securitygroup/ChangeSecurityGroupRuleCase.groovy	调整断言：不再期待非连续优先级抛出异常，改为允许添加/更新并在操作后校验规则存在；添加行为变更注释。
管理节点与并发控制 core/src/main/java/.../cloudbus/ResourceDestinationMakerImpl.java, portal/src/main/java/.../ManagementNodeManagerImpl.java, core/src/main/java/.../thread/DispatchQueueImpl.java	增加 synchronized / lifecycleLock 及两阶段缺失节点检测以防竞态；调度任务在 telemetry 情况下保留或不保留父追踪上下文（Conditional tracing），提高并发安全与心跳/事件一致性。
VM/网络小修正 compute/src/main/java/.../VmNicManagerImpl.java, header/src/main/java/.../vm/VmInstanceSpec.java, header/src/main/java/.../vm/VmInstanceState.java, network/src/main/java/.../l3/L3BasicNetwork.java	添加 VmNic 空值保护，root 磁盘大小回退取 virtual 与 actual 的较大值，Destroying 状态新增 stopped 转换；APIGetFreeIp 结果过滤掉 ReservedIpRange 范围内的 IP。
存储与网络服务改动 plugin/ceph/src/main/java/.../CephPrimaryStorageBase.java, plugin/zbs/src/main/java/.../ZbsStorageController.java, header/src/main/java/.../storage/addon/primary/ExternalPrimaryStorageInventory.java	快照删除容量释放改为按比率调用；ZBS 的 GetVolumeClients 改为可重试的 HttpCaller 调用并新增 setTryNext(bool)；为外部主存储脱敏 mdsUrls/mdsInfos。
负载均衡与错误码 plugin/loadBalancer/src/main/java/.../LoadBalancerApiInterceptor.java, utils/src/main/java/.../clouderrorcode/CloudOperationsErrorCode.java	拦截删除 SLB 场景以在灰度升级期间阻断删除操作（受全局配置控制）；新增备份取消超时错误码常量。

Sequence Diagram(s)

sequenceDiagram
    participant Heartbeat as Heartbeat/Reconciler
    participant Manager as ManagementNodeManager
    participant DB as Database
    participant HashRing as HashRing

    Note over Heartbeat,Manager: 周期性心跳/重建流程
    Heartbeat->>Manager: 检测到节点列表差异
    Manager->>DB: 查询 ManagementNodeVO（可能缺失）
    alt 节点在 DB 中存在
        Manager->>HashRing: schedule nodeJoin(on node's thread)
        HashRing-->>Manager: 更新/加入节点信息
    else 节点在 DB 中缺失（第一次）
        Manager->>Manager: 标记 suspectedMissingFromDb（暂存）
    else 节点在 DB 中缺失（连续检测）
        Manager->>HashRing: 从 hash ring 移除节点
        HashRing-->>Manager: 触发 nodeLeft 流程
    end

Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Poem

🐰🌿 优先级变得随意些，
正数为准不作堆，
节点心跳更谨慎，
存储呼叫会重试，
小兔轻跳庆改回。

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	标题遵循 [scope]: 格式，共67个字符，清晰准确地描述了PR的主要变化：移除安全组规则的严格顺序优先级限制。
Description check	✅ Passed	描述相关联地指向了具体的问题单号 ZSTAC-79067，说明了变更目的（移除过度严格的顺序优先级验证），并注明了来源。

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch sync/ye.zou/fix/ZSTAC-79067

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In
`@plugin/securityGroup/src/main/java/org/zstack/network/securitygroup/SecurityGroupApiInterceptor.java`:
- Around line 491-493: The priority validation in SecurityGroupApiInterceptor
currently only enforces ao.getPriority() > 0 and misses an upper bound; update
the check in the method that validates ao.getPriority() to also ensure
ao.getPriority() <= SECURITY_GROUP_RULES_NUM_LIMIT and throw an
ApiMessageInterceptionException with a new appropriate error code (instead of
ORG_ZSTACK_NETWORK_SECURITYGROUP_10042) when the value exceeds the limit, using
a clear error message that includes the provided priority and the max allowed
(reference SECURITY_GROUP_RULES_NUM_LIMIT and the validation block around
ao.getPriority()).

[coderabbitai]

🧹 Nitpick comments (2)

test/src/test/groovy/org/zstack/test/integration/networkservice/provider/flat/securitygroup/AddSecurityGroupRuleOptimizedCase.groovy (1)

612-617: 建议添加断言验证规则添加结果。

当前代码块添加了混合规则（ingress + egress）在优先级 12，但没有断言验证规则是否成功添加。与上方 594-600 行的处理方式（有 assert sg3.rules.find { it.priority == 13 } != null）保持一致会更好。

♻️ 建议的改进

         // ZSTAC-79067: mixed ingress+egress add at non-consecutive priority is now allowed
         sg3 = addSecurityGroupRule {
             securityGroupUuid = sg3.uuid
             rules = [rule_12, ingressRule]
             priority = 12
         }
+        assert sg3.rules.find { it.dstIpRange == "2.2.2.2-2.2.2.10" && it.priority == 12 } != null
+        assert sg3.rules.find { it.type == "Ingress" && it.dstPortRange == "12-13" } != null

test/src/test/groovy/org/zstack/test/integration/networkservice/provider/flat/securitygroup/ChangeSecurityGroupRuleCase.groovy (1)

234-236: 存在未使用的变量 rule_1。

方法 testChangeRulePriorityError 中，第 232 行获取了 rule_1 变量，但由于移除了连续优先级限制的测试断言，该变量现在未被使用。建议清理未使用的代码。

♻️ 建议的清理

     void testChangeRulePriorityError() {
         sg3 = querySecurityGroup {
             conditions = ["uuid=${sg3.uuid}"]
         }[0]

         assert sg3 != null
-        SecurityGroupRuleInventory rule_1 = sg3.rules.find { it.type == "Ingress" && it.priority == 1 && it.ipVersion == 4 }

         // ZSTAC-79067: priorities beyond current rule count are now allowed
         // (removed consecutive priority restriction)
     }