dohertj2/ScadaBridge
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Resolve all 46 low-severity architecture review findings

Browse Source
This commit is contained in:
Joseph Doherty
2026-09-09 22:56:36 -04:00
parent fef3e7675f
commit 9ee402bbcd
139 changed files with 2621 additions and 1082 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/ZB.MOM.WW.ScadaBridge.CentralUI.Tests/Auth/RoutePolicyCoverageTests.cs
+89
View File
@@ -0,0 +1,89 @@
using System.Reflection;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Components;
using ZB.MOM.WW.ScadaBridge.CentralUI.Components.Layout;
using ZB.MOM.WW.ScadaBridge.Security;
namespace ZB.MOM.WW.ScadaBridge.CentralUI.Tests.Auth;
public class RoutePolicyCoverageTests
{
[Fact]
public void EveryRoutableComponent_HasItsReviewedPolicy_IncludingExternalSecrets()
{
var expected = new Dictionary<string, string>
{
["/"] = "authenticated",
["/admin/api-keys"] = AuthorizationPolicies.RequireAdmin,
["/admin/api-keys/create"] = AuthorizationPolicies.RequireAdmin,
["/admin/api-keys/{KeyId}/edit"] = AuthorizationPolicies.RequireAdmin,
["/admin/ldap-mappings"] = AuthorizationPolicies.RequireAdmin,
["/admin/ldap-mappings/create"] = AuthorizationPolicies.RequireAdmin,
["/admin/ldap-mappings/{Id:int}/edit"] = AuthorizationPolicies.RequireAdmin,
["/admin/sites"] = AuthorizationPolicies.RequireAdmin,
["/admin/sites/create"] = AuthorizationPolicies.RequireAdmin,
["/admin/sites/{Id:int}/edit"] = AuthorizationPolicies.RequireAdmin,
["/audit/configuration"] = AuthorizationPolicies.OperationalAudit,
["/audit/execution-tree"] = AuthorizationPolicies.OperationalAudit,
["/audit/log"] = AuthorizationPolicies.OperationalAudit,
["/deployment/debug-view"] = AuthorizationPolicies.RequireDeployment,
["/deployment/deployments"] = AuthorizationPolicies.RequireDeployment,
["/deployment/flow-debugger"] = AuthorizationPolicies.RequireFlowDebugger,
["/deployment/instances"] = AuthorizationPolicies.RequireDeployment,
["/deployment/instances/create"] = AuthorizationPolicies.RequireDeployment,
["/deployment/instances/{Id:int}/configure"] = AuthorizationPolicies.RequireDeployment,
["/deployment/topology"] = AuthorizationPolicies.RequireDeployment,
["/design/api-methods/create"] = AuthorizationPolicies.RequireDesign,
["/design/api-methods/{Id:int}/edit"] = AuthorizationPolicies.RequireDesign,
["/design/connections"] = AuthorizationPolicies.RequireDesign,
["/design/connections/create"] = AuthorizationPolicies.RequireDesign,
["/design/connections/{Id:int}/certificates"] = AuthorizationPolicies.RequireAdmin,
["/design/connections/{Id:int}/edit"] = AuthorizationPolicies.RequireDesign,
["/design/data-connections"] = AuthorizationPolicies.RequireDesign,
["/design/data-connections/create"] = AuthorizationPolicies.RequireDesign,
["/design/data-connections/{Id:int}/edit"] = AuthorizationPolicies.RequireDesign,
["/design/db-connections/create"] = AuthorizationPolicies.RequireDesign,
["/design/db-connections/{Id:int}/edit"] = AuthorizationPolicies.RequireDesign,
["/design/external-systems"] = AuthorizationPolicies.RequireDesign,
["/design/external-systems/create"] = AuthorizationPolicies.RequireDesign,
["/design/external-systems/{Id:int}/edit"] = AuthorizationPolicies.RequireDesign,
["/design/schema-library"] = AuthorizationPolicies.RequireDesign,
["/design/shared-scripts"] = AuthorizationPolicies.RequireDesign,
["/design/shared-scripts/create"] = AuthorizationPolicies.RequireDesign,
["/design/shared-scripts/{Id:int}/edit"] = AuthorizationPolicies.RequireDesign,
["/design/templates"] = AuthorizationPolicies.RequireDesign,
["/design/templates/create"] = AuthorizationPolicies.RequireDesign,
["/design/templates/{Id:int}"] = AuthorizationPolicies.RequireDesign,
["/design/transport/export"] = AuthorizationPolicies.RequireDesign,
["/design/transport/import"] = AuthorizationPolicies.RequireAdmin,
["/login"] = "anonymous",
["/monitoring/alarms"] = AuthorizationPolicies.RequireDeployment,
["/monitoring/event-logs"] = AuthorizationPolicies.RequireDeployment,
["/monitoring/health"] = "authenticated",
["/monitoring/parked-messages"] = AuthorizationPolicies.RequireDeployment,
["/notifications/kpis"] = AuthorizationPolicies.RequireDeployment,
["/notifications/lists"] = AuthorizationPolicies.RequireDesign,
["/notifications/lists/create"] = AuthorizationPolicies.RequireDesign,
["/notifications/lists/{Id:int}/edit"] = AuthorizationPolicies.RequireDesign,
["/notifications/report"] = AuthorizationPolicies.RequireDeployment,
["/notifications/sms"] = AuthorizationPolicies.RequireAdmin,
["/notifications/smtp"] = AuthorizationPolicies.RequireAdmin,
["/operations/secured-writes"] = AuthorizationPolicies.RequireSecuredWriteAccess,
["/site-calls/report"] = AuthorizationPolicies.RequireDeployment,
["/admin/secrets"] = "secrets:manage",
};
var actual = new Dictionary<string, string>();
foreach (var type in new[] { typeof(MainLayout).Assembly, typeof(ZB.MOM.WW.Secrets.Ui.SecretsPage).Assembly }
.SelectMany(a => a.GetTypes()))
{
foreach (var route in type.GetCustomAttributes<RouteAttribute>())
{
var anonymous = type.IsDefined(typeof(AllowAnonymousAttribute));
var authorization = type.GetCustomAttributes<AuthorizeAttribute>().ToArray();
Assert.True(anonymous || authorization.Length > 0, $"Missing authorization: {route.Template}");
actual.Add(route.Template, anonymous ? "anonymous" : Assert.Single(authorization).Policy ?? "authenticated");
}
}
Assert.Equal(expected.OrderBy(x => x.Key), actual.OrderBy(x => x.Key));
}
}