feat(auth)!: ScadaBridge retire SQL Server ApiKey entity + ApprovedApiKeyIds + legacy hashing; EF migration RetireInboundApiKeyStore; re-issue runbook + CHANGELOG (re-arch C5/E) — BREAKING: X-API-Key -> Bearer sbk_, keys re-issued

2026-06-02 05:39:59 -04:00
parent b13d7b3d28
commit afa55981d5
32 changed files with 2117 additions and 1193 deletions
@@ -1,49 +0,0 @@
-using ZB.MOM.WW.ScadaBridge.Commons.Entities.InboundApi;
-using ZB.MOM.WW.ScadaBridge.Commons.Types.InboundApi;
-
-namespace ZB.MOM.WW.ScadaBridge.Commons.Tests.Entities;
-
-/// <summary>
-/// ConfigurationDatabase-012: the <see cref="ApiKey"/> entity must never carry the
-/// plaintext bearer credential as a persisted field — only its deterministic hash.
-/// </summary>
-public class ApiKeyTests
-{
-    [Fact]
-    public void ApiKey_HasNoPlaintextKeyValueProperty()
-    {
-        // The plaintext key is shown to the operator once at creation and is never
-        // persisted. The entity must therefore expose KeyHash, not KeyValue.
-        var properties = typeof(ApiKey).GetProperties().Select(p => p.Name).ToArray();
-
-        Assert.DoesNotContain("KeyValue", properties);
-        Assert.Contains("KeyHash", properties);
-    }
-
-    [Fact]
-    public void Constructor_FromPlaintext_StoresHashNotPlaintext()
-    {
-        var key = new ApiKey("MES-Production", "the-secret-key-value");
-
-        Assert.NotEqual("the-secret-key-value", key.KeyHash);
-        Assert.Equal(ApiKeyHasher.Default.Hash("the-secret-key-value"), key.KeyHash);
-    }
-
-    [Fact]
-    public void FromHash_StoresHashVerbatim()
-    {
-        var key = ApiKey.FromHash("RecipeManager-Dev", "precomputed-hash-value");
-
-        Assert.Equal("RecipeManager-Dev", key.Name);
-        Assert.Equal("precomputed-hash-value", key.KeyHash);
-    }
-
-    [Fact]
-    public void Constructor_NullArguments_Throw()
-    {
-        Assert.Throws<ArgumentNullException>(() => new ApiKey(null!, "value"));
-        Assert.Throws<ArgumentNullException>(() => new ApiKey("name", (string)null!));
-        Assert.Throws<ArgumentNullException>(() => ApiKey.FromHash(null!, "hash"));
-        Assert.Throws<ArgumentNullException>(() => ApiKey.FromHash("name", null!));
-    }
-}