dohertj2/ScadaBridge
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(security): additive permitted-sites filter on secured-write query/count (plan R2-07 T5)

Browse Source
This commit is contained in:
Joseph Doherty
2026-07-13 10:48:45 -04:00
parent 9b9222d223
commit 92936747b7
3 changed files with 98 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/ZB.MOM.WW.ScadaBridge.Commons/Interfaces/Repositories/ISecuredWriteRepository.cs
+16 -1
View File
@@ -46,6 +46,11 @@ public interface ISecuredWriteRepository
/// <param name="siteId">Site id filter; <c>null</c> matches every site.</param>
/// <param name="skip">Number of rows to skip (offset paging).</param>
/// <param name="take">Maximum number of rows to return.</param>
/// <param name="permittedSiteIds">When non-null, only rows whose <c>SiteId</c> (site
/// identifier) is in the set match; <c>null</c> matches every site. Applied IN ADDITION
/// to <paramref name="siteId"/>. Used by the ManagementActor to constrain an unfiltered
/// list to a site-scoped caller's permitted sites at the query level (arch-review R2 N3),
/// so paging and totals stay correct.</param>
/// <param name="ct">Cancellation token.</param>
/// <returns>A task that resolves to a page of matching rows, newest submission first.</returns>
Task<IReadOnlyList<PendingSecuredWrite>> QueryAsync(
@@ -53,6 +58,7 @@ public interface ISecuredWriteRepository
string? siteId,
int skip,
int take,
IReadOnlyCollection<string>? permittedSiteIds = null,
CancellationToken ct = default);
/// <summary>
@@ -106,7 +112,16 @@ public interface ISecuredWriteRepository
/// </summary>
/// <param name="status">Status filter; <c>null</c> matches every status.</param>
/// <param name="siteId">Site id filter; <c>null</c> matches every site.</param>
/// <param name="permittedSiteIds">When non-null, only rows whose <c>SiteId</c> (site
/// identifier) is in the set match; <c>null</c> matches every site. Applied IN ADDITION
/// to <paramref name="siteId"/>. Used by the ManagementActor to constrain an unfiltered
/// list to a site-scoped caller's permitted sites at the query level (arch-review R2 N3),
/// so paging and totals stay correct.</param>
/// <param name="ct">Cancellation token.</param>
/// <returns>A task that resolves to the count of matching rows.</returns>
Task<int> CountAsync(string? status, string? siteId, CancellationToken ct = default);
Task<int> CountAsync(
string? status,
string? siteId,
IReadOnlyCollection<string>? permittedSiteIds = null,
CancellationToken ct = default);
}
src/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase/Repositories/SecuredWriteRepository.cs
+16 -1
View File
@@ -57,6 +57,7 @@ public class SecuredWriteRepository : ISecuredWriteRepository
string? siteId,
int skip,
int take,
IReadOnlyCollection<string>? permittedSiteIds = null,
CancellationToken ct = default)
{
IQueryable<PendingSecuredWrite> query = _context.Set<PendingSecuredWrite>()
@@ -72,6 +73,11 @@ public class SecuredWriteRepository : ISecuredWriteRepository
query = query.Where(p => p.SiteId == siteId);
}
if (permittedSiteIds is not null)
{
query = query.Where(p => permittedSiteIds.Contains(p.SiteId));
}
return await query
.OrderByDescending(p => p.SubmittedAtUtc)
.ThenByDescending(p => p.Id)
@@ -128,7 +134,11 @@ WHERE Id = {id}
}
/// <inheritdoc />
public async Task<int> CountAsync(string? status, string? siteId, CancellationToken ct = default)
public async Task<int> CountAsync(
string? status,
string? siteId,
IReadOnlyCollection<string>? permittedSiteIds = null,
CancellationToken ct = default)
{
IQueryable<PendingSecuredWrite> query = _context.Set<PendingSecuredWrite>()
.AsNoTracking();
@@ -143,6 +153,11 @@ WHERE Id = {id}
query = query.Where(p => p.SiteId == siteId);
}
if (permittedSiteIds is not null)
{
query = query.Where(p => permittedSiteIds.Contains(p.SiteId));
}
return await query.CountAsync(ct);
}
}
tests/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.Tests/SecuredWriteRepositoryTests.cs
+66
View File
@@ -164,6 +164,72 @@ public class SecuredWriteRepositoryTests : IClassFixture<MsSqlMigrationFixture>
Assert.Equal(0, await repo.CountAsync(status: "Executed", siteId: siteId));
}
[SkippableFact]
public async Task QueryAsync_PermittedSiteIds_ReturnsOnlyPermittedRows()
{
Skip.IfNot(_fixture.Available, _fixture.SkipReason);
// Distinct per-run site identifiers stand in for "SITE1"/"SITE2"/"SITE3" so the
// permitted-set filter is asserted deterministically against a shared MSSQL.
var site1 = NewSiteId();
var site2 = NewSiteId();
var site3 = NewSiteId();
await using var context = CreateContext();
var repo = new SecuredWriteRepository(context);
await repo.AddAsync(NewRow(site1, status: "Pending"));
await repo.AddAsync(NewRow(site1, status: "Pending"));
await repo.AddAsync(NewRow(site2, status: "Pending"));
await repo.AddAsync(NewRow(site3, status: "Pending"));
var rows = await repo.QueryAsync(status: null, siteId: null, skip: 0, take: 100,
permittedSiteIds: new[] { site1, site3 });
Assert.Equal(3, rows.Count);
Assert.DoesNotContain(rows, r => r.SiteId == site2);
}
[SkippableFact]
public async Task CountAsync_PermittedSiteIds_CountsOnlyPermittedRows()
{
Skip.IfNot(_fixture.Available, _fixture.SkipReason);
var site1 = NewSiteId();
var site2 = NewSiteId();
var site3 = NewSiteId();
await using var context = CreateContext();
var repo = new SecuredWriteRepository(context);
await repo.AddAsync(NewRow(site1, status: "Pending"));
await repo.AddAsync(NewRow(site1, status: "Pending"));
await repo.AddAsync(NewRow(site2, status: "Pending"));
await repo.AddAsync(NewRow(site3, status: "Pending"));
var count = await repo.CountAsync(status: null, siteId: null,
permittedSiteIds: new[] { site1, site3 });
Assert.Equal(3, count);
}
[SkippableFact]
public async Task QueryAsync_NullPermittedSiteIds_IsUnfiltered_BackCompat()
{
Skip.IfNot(_fixture.Available, _fixture.SkipReason);
// 4 rows on a single unique site; null permittedSiteIds must not filter them
// out — exactly today's behavior.
var siteId = NewSiteId();
await using var context = CreateContext();
var repo = new SecuredWriteRepository(context);
await repo.AddAsync(NewRow(siteId, status: "Pending"));
await repo.AddAsync(NewRow(siteId, status: "Pending"));
await repo.AddAsync(NewRow(siteId, status: "Executed"));
await repo.AddAsync(NewRow(siteId, status: "Rejected"));
var rows = await repo.QueryAsync(status: null, siteId: siteId, skip: 0, take: 100,
permittedSiteIds: null);
Assert.Equal(4, rows.Count);
}
// --- helpers ------------------------------------------------------------
private ScadaBridgeDbContext CreateContext()