From 008976f3d80d31c875ddfa61185a2ddc71ba3f24 Mon Sep 17 00:00:00 2001 From: Joseph Doherty Date: Thu, 22 Oct 2026 09:28:16 -0400 Subject: [PATCH] docs(management): DebugStreamHub comments name bearer + Basic auth (review 2026-10-21 lane K follow-up) --- .../DebugStreamHub.cs | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/src/ZB.MOM.WW.ScadaBridge.ManagementService/DebugStreamHub.cs b/src/ZB.MOM.WW.ScadaBridge.ManagementService/DebugStreamHub.cs index 7b72e1d9..d7b30047 100644 --- a/src/ZB.MOM.WW.ScadaBridge.ManagementService/DebugStreamHub.cs +++ b/src/ZB.MOM.WW.ScadaBridge.ManagementService/DebugStreamHub.cs @@ -11,8 +11,9 @@ namespace ZB.MOM.WW.ScadaBridge.ManagementService; /// /// SignalR hub for real-time debug stream subscriptions. -/// External consumers (CLI) connect via WebSocket, authenticate with Basic Auth, -/// and receive streaming attribute value and alarm state changes. +/// External consumers (CLI) connect via WebSocket, authenticate through +/// — a bearer JWT minted by POST /auth/token, or +/// HTTP Basic (LDAP bind) — and receive streaming attribute value and alarm state changes. /// public class DebugStreamHub : Hub { @@ -74,10 +75,10 @@ public class DebugStreamHub : Hub return; } - // Authenticate via the SAME shared Basic→LDAP flow as POST /management and the - // audit REST (arch-review R2 N1): ManagementAuthenticator applies the DisableLogin - // bypass, the LoginThrottle lockout check BEFORE the bind, and RecordFailure/ - // RecordSuccess bookkeeping — so hub connection attempts can no longer be used as + // Authenticate via the SAME shared flow as POST /management and the audit REST + // (arch-review R2 N1): ManagementAuthenticator applies the DisableLogin bypass, accepts + // a bearer JWT (no LDAP bind) or Basic→LDAP with the LoginThrottle lockout check + // BEFORE the bind, and RecordFailure/RecordSuccess bookkeeping — so hub connection attempts can no longer be used as // an unthrottled LDAP-bind oracle, and hub failures feed the shared lockout. var outcome = await ManagementAuthenticator.AuthenticateAsync(httpContext); if (outcome.User is null)