dohertj2/ScadaBridge
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(centralui-auth): memoize non-authoritative circuit auth-state reads for 10 s (review 2026-10-21 07/P-3)

Browse Source 
GetAuthenticationStateAsync (display reads: current username, nav role checks) used
to force a full revalidation + DB role re-map on every call. It now reuses the
circuit's last revalidation for NonAuthoritativeRefreshInterval (10 s);
GetAuthoritativeStateAsync (mutation gates, UI-13) still re-maps every time and
fails closed. The revocation regression test now asserts through the authoritative
read, which is what every gate uses.
This commit is contained in:
Joseph Doherty
2026-10-22 06:38:44 -04:00
parent 77b3a2c23f
commit f0de11c446
3 changed files with 129 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/ZB.MOM.WW.ScadaBridge.CentralUI.Tests/Auth/CircuitRevocationRegressionTests.cs
+4 -1
View File
@@ -66,7 +66,10 @@ public class CircuitRevocationRegressionTests
var sites = new SiteScopeService(auth);
Assert.True(await sites.IsSiteAllowedAsync(1));
mapping = new RoleMappingResult([Roles.Viewer], ["2"], false);
var refreshed = await auth.GetAuthenticationStateAsync();
// Authoritative read: a non-authoritative read may reuse the circuit's last
// revalidation for CookieAuthenticationStateProvider.NonAuthoritativeRefreshInterval
// (review 2026-10-21 07/P-3); every gate below is authoritative.
var refreshed = await auth.GetAuthoritativeStateAsync();
Assert.DoesNotContain(Roles.Deployer, refreshed.User.FindAll(JwtTokenService.RoleClaimType).Select(c => c.Value));
Assert.False(await sites.IsSiteAllowedAsync(1));
Assert.True(await sites.IsSiteAllowedAsync(2));