feat(host): fail-fast DisableLogin environment guard at composition root

2026-07-08 14:52:00 -04:00
parent 74c295e37a
commit 7231c2044b
2 changed files with 10 additions and 2 deletions
@@ -135,6 +135,14 @@ try
        var disableLogin = builder.Configuration
            .GetSection(ZB.MOM.WW.ScadaBridge.Security.Auth.AuthDisableLoginOptions.SectionName)
            .GetValue<bool>(nameof(ZB.MOM.WW.ScadaBridge.Security.Auth.AuthDisableLoginOptions.DisableLogin));
+        // Fail-fast guard: DisableLogin outside Development requires the explicit
+        // AllowOutsideDevelopment acknowledgement key. See DisableLoginGuard.
+        ZB.MOM.WW.ScadaBridge.Security.Auth.DisableLoginGuard.Validate(
+            disableLogin,
+            builder.Environment.EnvironmentName,
+            builder.Configuration
+                .GetSection(ZB.MOM.WW.ScadaBridge.Security.Auth.AuthDisableLoginOptions.SectionName)
+                .GetValue<bool>(nameof(ZB.MOM.WW.ScadaBridge.Security.Auth.AuthDisableLoginOptions.AllowOutsideDevelopment)));
        builder.Services.AddSecurity(disableLogin);
        builder.Services.AddCentralUI();
        builder.Services.AddInboundAPI();