Joseph Doherty
9cff87fe85
Remove project bookkeeping citations from shipped code comments across the solution: hyphenated task IDs (WP-14, StoreAndForward-025), milestone/task/ issue refs (M3, Task 4, Audit Log #23, #21), Bundle X task-bundle labels, and C/D/K/S/T phase labels. Comment text only — no code logic, string/log literals, or XML-doc structure changed. Genuine descriptions are preserved (only the citation is stripped), and technical lookalikes are retained (UTF-8, SHA-256, T00:00:00, M365, UTC-5, pre-C4/pre-C5 schema versions). Flagged by the new CommentChecker TaskReferenceInComment / TrackingReferenceInComment checks plus targeted grep passes; full solution builds clean, append-only guard tests pass.
48 lines
2.5 KiB
C#
48 lines
2.5 KiB
C#
using ZB.MOM.WW.Auth.Abstractions.Roles;
|
|
|
|
namespace ZB.MOM.WW.ScadaBridge.Security;
|
|
|
|
/// <summary>
|
|
/// Adapts ScadaBridge's DB-backed <see cref="RoleMapper"/> to the shared
|
|
/// <see cref="IGroupRoleMapper{TRole}"/> seam from <c>ZB.MOM.WW.Auth.Abstractions</c>.
|
|
/// </summary>
|
|
/// <remarks>
|
|
/// This is an <b>additive</b> wrapper for the Auth-library adoption. It does not
|
|
/// re-implement the LDAP-group → role resolution or the site-scope union semantics — it
|
|
/// delegates wholesale to <see cref="RoleMapper.MapGroupsToRolesAsync"/> and re-shapes the
|
|
/// result onto the shared contract. <typeparamref name="TRole"/> is <see cref="string"/>
|
|
/// because ScadaBridge roles travel as plain strings in claims. The full
|
|
/// <see cref="RoleMappingResult"/> — including <see cref="RoleMappingResult.PermittedSiteIds"/>
|
|
/// and <see cref="RoleMappingResult.IsSystemWideDeployment"/> — is carried verbatim in the
|
|
/// mapping's opaque <see cref="GroupRoleMapping{TRole}.Scope"/> so no site-scope information
|
|
/// is lost across the seam. The existing login flow is rewired to consume this in a later task.
|
|
/// </remarks>
|
|
public sealed class ScadaBridgeGroupRoleMapper : IGroupRoleMapper<string>
|
|
{
|
|
private readonly RoleMapper _roleMapper;
|
|
|
|
/// <summary>Initializes the mapper with the wrapped <see cref="RoleMapper"/>.</summary>
|
|
/// <param name="roleMapper">The DB-backed role mapper whose union semantics are reused.</param>
|
|
public ScadaBridgeGroupRoleMapper(RoleMapper roleMapper)
|
|
{
|
|
_roleMapper = roleMapper ?? throw new ArgumentNullException(nameof(roleMapper));
|
|
}
|
|
|
|
/// <summary>
|
|
/// Maps a list of LDAP/AD group names to ScadaBridge roles using the wrapped
|
|
/// <see cref="RoleMapper"/> and returns the resulting role mapping with site-scope
|
|
/// information carried in the opaque <c>Scope</c> field.
|
|
/// </summary>
|
|
/// <param name="groups">The AD/LDAP group names to resolve into roles.</param>
|
|
/// <param name="ct">Cancellation token.</param>
|
|
/// <returns>A task that resolves to the group-to-role mapping including permitted site identifiers.</returns>
|
|
public async Task<GroupRoleMapping<string>> MapAsync(IReadOnlyList<string> groups, CancellationToken ct)
|
|
{
|
|
var result = await _roleMapper.MapGroupsToRolesAsync(groups, ct);
|
|
|
|
// Carry the full RoleMappingResult as the opaque Scope so the site-scope
|
|
// payload (PermittedSiteIds + IsSystemWideDeployment) survives the seam.
|
|
return new GroupRoleMapping<string>(result.Roles, Scope: result);
|
|
}
|
|
}
|