dohertj2/ScadaBridge
1
0
Fork 0
Code Issues 1 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

feat(management): any-of role gates; restrict ListSecuredWrites to Operator/Verifier/Admin (arch-review UA1)

Browse Source 
Claude-Session: https://claude.ai/code/session_01MtdgwpEeCUn6cUA5f1LMPj
This commit is contained in:
Joseph Doherty
2026-07-10 05:03:51 -04:00
parent 4fb754f9f6
commit 6c9de9f7ab
8 changed files with 133 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/ZB.MOM.WW.ScadaBridge.ManagementService.Tests/SecuredWriteHandlerTests.cs
+6 -2
View File
@@ -352,7 +352,10 @@ public class SecuredWriteHandlerTests : TestKit, IDisposable
});
var actor = CreateActor();
var envelope = Envelope(new ListSecuredWritesCommand("Pending", "SITE1"), "carol", "Viewer");
// arch-review UA1: ListSecuredWrites is gated to the Secured Write
// roles + Administrator, so use Operator here (this test asserts filter
// forwarding, not the role gate — see ListSecuredWrites_* auth tests).
var envelope = Envelope(new ListSecuredWritesCommand("Pending", "SITE1"), "carol", "Operator");
actor.Tell(envelope);
@@ -370,7 +373,8 @@ public class SecuredWriteHandlerTests : TestKit, IDisposable
.Returns(new List<PendingSecuredWrite>());
var actor = CreateActor();
var envelope = Envelope(new ListSecuredWritesCommand(null, null), "carol");
// arch-review UA1: gated read — Operator satisfies the any-of gate.
var envelope = Envelope(new ListSecuredWritesCommand(null, null), "carol", "Operator");
actor.Tell(envelope);