7 Commits

Author	SHA1	Message	Date
Joseph Doherty	a1bdd94d4c	feat(mgmt): /api/audit/{query,export} endpoints with permission gates (#23 M8)	2026-05-20 21:49:14 -04:00
Joseph Doherty	a58cec5776	fix(security): resolve Security-012..015 — fail login on partial LDAP outage, escape-aware DN parsing, idle check on refresh, username normalization	2026-05-17 03:18:33 -04:00
Joseph Doherty	84a696b0e4	fix(security): resolve Security-009,010,011 — LDAP connection timeout, design-doc correction, security-path test coverage; Security-008 deferred	2026-05-16 22:24:03 -04:00
Joseph Doherty	30ebbdd183	fix(security): resolve Security-004..007 — configurable user-id attribute, DN escaping, JWT issuer/audience validation, idle-timeout preservation	2026-05-16 21:22:01 -04:00
Joseph Doherty	0d9363766d	fix(security): resolve Security-001/002/003 — reachable StartTLS path, Secure cookie, JWT signing key validation	2026-05-16 19:47:17 -04:00
Joseph Doherty	4879c4e01e	Fix auth, Bootstrap, Blazor nav, LDAP, and deployment pipeline for working Central UI ... Bootstrap served locally with absolute paths and <base href="/">. LDAP auth uses search-then-bind with service account for GLAuth compatibility. CookieAuthenticationStateProvider reads HttpContext.User instead of parsing JWT. Login/logout forms opt out of Blazor enhanced nav (data-enhance="false"). Nav links use absolute paths; seed data includes Design/Deployment group mappings. DataConnections page loads all connections (not just site-assigned). Site appsettings configured for Test Plant A; Site registers with Central on startup. DeploymentService resolves string site identifier for Akka routing. Instances page gains Create Instance form.	2026-03-17 10:03:06 -04:00
Joseph Doherty	cafb7d2006	Phase 1 WP-2–10: Repositories, audit service, security & auth (LDAP, JWT, roles, policies, data protection) ... - WP-2: SecurityRepository + CentralUiRepository with audit log queries - WP-3: AuditService with transactional guarantee (same SaveChangesAsync) - WP-4: Optimistic concurrency tests (deployment records vs template last-write-wins) - WP-5: Seed data (SCADA-Admins → Admin role mapping) - WP-6: LdapAuthService (direct bind, TLS enforcement, group query) - WP-7: JwtTokenService (HMAC-SHA256, 15-min refresh, 30-min idle timeout) - WP-8: RoleMapper (LDAP groups → roles with site-scoped deployment) - WP-9: Authorization policies (Admin/Design/Deployment + site scope handler) - WP-10: Shared Data Protection keys via EF Core 141 tests pass, zero warnings.	2026-03-16 19:32:43 -04:00