Add admin-mode enablement for disabled event log channels

[jschick04]

Summary

Adds the ability to enable a disabled Windows event log channel in place, without leaving the app, but only when EventLogExpert is already running elevated (admin mode). Surfaced in the scenario readiness dashboard: elevated users get an "Enable channel" button on a required-but-disabled channel; non-elevated users get an honest hint to restart as administrator (there is no in-app elevation or relaunch-as-admin path).

Approach

• In-process, elevation-gated. No elevated helper, no IPC, no relaunch-as-admin (all previously rejected). The DatabaseTools IPC surface stays database-only. Enablement runs in-process, gated on the process already being elevated (IWindowsIdentityProvider.IsUserInAdministratorRole).
• Native write path (EventLogExpert.Eventing/Writers/): EvtOpenChannelConfig then read-first EvtGetChannelConfigProperty then EvtSetChannelConfigProperty(EvtChannelConfigEnabled, true) then EvtSaveChannelConfig.

Safety design

• Fail-closed read. A failed or non-Boolean read maps to a typed failure, never treated as "disabled".
• Committed-save model. EvtSaveChannelConfig returning TRUE is the persistence guarantee; no post-save re-read. GetLastWin32Error is captured immediately after each failing P/Invoke, before the handle dispose clobbers it.
• System-channel exclusion. Application/System/Security are excluded by name (Win32 forbids toggling their Enabled).
• Confirmation + disclosure. A confirm dialog names the channel, states the change is persistent and machine-wide, and (for analytic/debug channels) warns records may be cleared. The whole action is busy-guarded.
• Cancellation contract. Cancellation is honored up to the moment the native write starts; once it starts it runs to completion, so a committed machine change is never reported cancelled.
• Full-snapshot refresh. After a successful enable, the full channel readiness set is re-fetched (not a single-channel reprobe, which would corrupt the presence snapshot).

Tests

• 18 new unit tests (Runtime service: guard / cancellation / invalidate; ScenarioDetail: eligibility / button / hint; dashboard: confirm to enable to refresh flow).
• Native round-trip integration test (enables a real disabled analytic/debug channel, verifies persistence, restores it). Gated behind a dedicated EVENTLOG_ALLOW_CHANNEL_MUTATION opt-in set only in the throwaway container (compose.yml) and CI (PullRequest.yml); EVENTLOG_CONTAINER=1 alone (the documented host opt-in) deliberately does not run it, so a developer host is never mutated.
• Local suites green: Eventing 716, Runtime 2008, UI 1170.

Feature 1 Phase 2 of the roadmap.

[Copilot]

Pull request overview

Adds an admin-only, in-process flow to enable disabled Windows Event Log channels directly from the scenario readiness dashboard, backed by a native wevtapi writer and guarded by elevation checks and confirmation UX.

Changes:

• Introduces IChannelConfigWriter + ChannelConfigWriter to persist EvtChannelConfigEnabled=true via EvtOpenChannelConfig/EvtSetChannelConfigProperty/EvtSaveChannelConfig.
• Adds IChannelEnableService + UI wiring to surface an “Enable channel” action for eligible disabled required channels (or an elevation hint when not elevated).
• Expands unit/integration tests and gates mutation integration tests behind EVENTLOG_ALLOW_CHANNEL_MUTATION (wired into compose + CI).

Reviewed changes

Copilot reviewed 24 out of 24 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
tests/Unit/EventLogExpert.UI.Tests/Dashboard/ScenarioDetailTests.cs	Adds unit tests for enable-button visibility/click behavior and non-admin hint.
tests/Unit/EventLogExpert.UI.Tests/Dashboard/EmptyStateDashboardTests.cs	Adds unit tests for confirm-cancel and confirm-enable + readiness refresh behavior.
tests/Unit/EventLogExpert.Runtime.Tests/Scenarios/ChannelEnableServiceTests.cs	Adds unit tests for elevation gating, cancellation contract, and readiness invalidation.
tests/Integration/README.md	Documents the third gate (EVENTLOG_ALLOW_CHANNEL_MUTATION) for mutation integration tests.
tests/Integration/EventLogExpert.Eventing.IntegrationTests/Writers/ChannelConfigWriterIntegrationTests.cs	Adds mutation-gated integration coverage for enable + restore flow and not-found behavior.
src/EventLogExpert.UI/Dashboard/ScenarioDetail.razor.css	Styles the new “Enable channel” button and non-admin hint.
src/EventLogExpert.UI/Dashboard/ScenarioDetail.razor.cs	Adds parameters/callbacks and eligibility logic (present+disabled+non-system channel).
src/EventLogExpert.UI/Dashboard/ScenarioDetail.razor	Renders enable action or elevation hint inline with channel readiness facts.
src/EventLogExpert.UI/Dashboard/ScenarioBrowserPanel.razor.cs	Plumbs enable capability + callback through the scenario browser panel.
src/EventLogExpert.UI/Dashboard/ScenarioBrowserPanel.razor	Passes enable capability + callback into ScenarioDetail.
src/EventLogExpert.UI/Dashboard/EmptyStateDashboard.razor.cs	Adds enable flow (confirm → service enable → refresh readiness) and error messaging.
src/EventLogExpert.UI/Dashboard/EmptyStateDashboard.razor	Wires dashboard to pass CanEnableChannels + OnEnableChannel to scenario panel.
src/EventLogExpert.UI/Common/EnableChannelConfirmation.cs	Implements the confirmation dialog content for channel enablement.
src/EventLogExpert.Runtime/Scenarios/IChannelEnableService.cs	Defines the runtime service contract for gated enable attempts.
src/EventLogExpert.Runtime/Scenarios/ChannelEnableService.cs	Implements elevation gating, cancellation semantics, and readiness invalidation.
src/EventLogExpert.Runtime/DependencyInjection/RuntimeServiceCollectionExtensions.cs	Registers IChannelConfigWriter and IChannelEnableService in runtime DI.
src/EventLogExpert.Eventing/Writers/IChannelConfigWriter.cs	Introduces writer interface for persisting channel enablement.
src/EventLogExpert.Eventing/Writers/ChannelEnableResult.cs	Adds result record carrying outcome + Win32 error.
src/EventLogExpert.Eventing/Writers/ChannelEnableOutcome.cs	Adds typed outcomes (Enabled/AlreadyEnabled/NotElevated/etc.).
src/EventLogExpert.Eventing/Writers/ChannelConfigWriter.cs	Implements native write path with read-first fail-closed behavior.
src/EventLogExpert.Eventing/Interop/NativeMethods.Evt.cs	Adds P/Invokes for EvtSetChannelConfigProperty and EvtSaveChannelConfig.
src/EventLogExpert.Eventing/Interop/EvtVariant.cs	Adds boolean ctor to ensure deterministic union initialization for native calls.
compose.yml	Enables mutation integration tests in container via EVENTLOG_ALLOW_CHANNEL_MUTATION=1.
.github/workflows/PullRequest.yml	Enables mutation integration tests in CI via EVENTLOG_ALLOW_CHANNEL_MUTATION=1.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 24 out of 24 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

src/EventLogExpert.Eventing/Writers/IChannelConfigWriter.cs:10

• The XML doc implies a non-elevated caller will always get AccessDenied, but this writer can also return other outcomes (e.g., NotFound) and non-elevation may fail at different stages. It would be more accurate to describe AccessDenied as a common/expected failure mode rather than a guarantee.

    ///     Enables a disabled event log channel by persisting <c>EvtChannelConfigEnabled = true</c>. Requires an elevated
    ///     process; without elevation a native call fails and the result is <see cref="ChannelEnableOutcome.AccessDenied" />.

[ryanriesMSFT]

👍

[Copilot]

Pull request overview

Copilot reviewed 24 out of 24 changed files in this pull request and generated no new comments.