dohertj2/ScadaBridge
1
0
Fork 0
Code Issues 1 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

feat(management): any-of role gates; restrict ListSecuredWrites to Operator/Verifier/Admin (arch-review UA1)

Browse Source 
Claude-Session: https://claude.ai/code/session_01MtdgwpEeCUn6cUA5f1LMPj
This commit is contained in:
Joseph Doherty
2026-07-10 05:03:51 -04:00
parent 4fb754f9f6
commit 6c9de9f7ab
8 changed files with 133 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/ZB.MOM.WW.ScadaBridge.Security.Tests/SecurityTests.cs
+22
View File
@@ -1242,6 +1242,28 @@ public class AuthorizationPolicyTests
Assert.False(await EvaluatePolicy(AuthorizationPolicies.RequireOperator, verifierOnly));
}
[Theory]
[InlineData("Operator")]
[InlineData("Verifier")]
[InlineData("Administrator")]
public async Task RequireSecuredWriteAccess_SecuredWriteRoles_Satisfy(string role)
{
// arch-review UA1: the Secured Writes history exposes process-sensitive
// tag values, so read access is any-of {Operator, Verifier, Administrator}.
var principal = CreatePrincipal(new[] { role });
Assert.True(await EvaluatePolicy(AuthorizationPolicies.RequireSecuredWriteAccess, principal));
}
[Theory]
[InlineData("Viewer")]
[InlineData("Designer")]
[InlineData("Deployer")]
public async Task RequireSecuredWriteAccess_OtherRoles_Denied(string role)
{
var principal = CreatePrincipal(new[] { role });
Assert.False(await EvaluatePolicy(AuthorizationPolicies.RequireSecuredWriteAccess, principal));
}
private static ClaimsPrincipal CreatePrincipal(string[] roles, string[]? siteIds = null)
{
var claims = new List<Claim>();