working epics ioc and tested

internal/datasource/epics/epics.go

@@ -342,10 +342,10 @@ func (e *EPICS) GetMetadata(ctx context.Context, signal string) (datasource.Meta
 
 // fetchMetadata retrieves metadata from a connected chid using ca_get.
 func (e *EPICS) fetchMetadata(chid C.chid, name string) datasource.Metadata {
-	// In EPICS, write access is governed by CA security (host/user rules), not
-	// by the field type.  Default to writable=true; the IOC will reject puts
-	// that violate its security policy.
-	meta := datasource.Metadata{Name: name, Writable: true}
+	// ca_write_access returns 1 if CA security permits puts from this client.
+	// This reflects the IOC's actual security policy (host/user ACLs), so we
+	// use it directly rather than defaulting to true and relying on put failures.
+	meta := datasource.Metadata{Name: name, Writable: C.ca_write_access(chid) != 0}
 
 	fieldType := C.ca_field_type(chid)
 	count := C.ca_element_count(chid)

internal/datasource/synthetic/synthetic.go

@@ -286,6 +286,52 @@ func (s *Synthetic) RemoveSignal(name string) error {
 	return nil
 }
 
+// GetSignal returns the definition of a single named signal.
+func (s *Synthetic) GetSignal(name string) (SignalDef, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	st, ok := s.signals[name]
+	if !ok {
+		return SignalDef{}, datasource.ErrNotFound
+	}
+	return st.def, nil
+}
+
+// UpdateSignal replaces the pipeline of an existing synthetic signal at runtime
+// and persists the change. The signal must already exist.
+func (s *Synthetic) UpdateSignal(def SignalDef) error {
+	if def.Name == "" {
+		return errors.New("signal name must not be empty")
+	}
+
+	nodes, err := BuildPipeline(def.Pipeline)
+	if err != nil {
+		return fmt.Errorf("build pipeline: %w", err)
+	}
+
+	states := make([]map[string]any, len(nodes))
+	for i := range states {
+		states[i] = make(map[string]any)
+	}
+
+	s.mu.Lock()
+	old, exists := s.signals[def.Name]
+	if !exists {
+		s.mu.Unlock()
+		return datasource.ErrNotFound
+	}
+	if old.cancel != nil {
+		old.cancel()
+	}
+	s.signals[def.Name] = &signalState{def: def, nodes: nodes, states: states}
+	s.mu.Unlock()
+
+	if err := s.saveDefs(); err != nil {
+		return fmt.Errorf("persist definitions: %w", err)
+	}
+	return nil
+}
+
 // GetDefs returns a copy of all current signal definitions (for the REST API).
 func (s *Synthetic) GetDefs() []SignalDef {
 	s.mu.RLock()