Joseph Doherty
513fa1aa16
Comment/XML-doc changes only: - add summaries to ~10k test methods, fixtures, fakes and helpers (+ <param> on theories, <returns> on async Task methods, <inheritdoc/> on interface implementations the checker can resolve) - strip ~2.6k project-tracking references (WP*, P*-*, row-NN, Task N, #NN, Component-0NN) from comments, keeping the explanatory text; reword false positives in comments only - real docs on fakes implementing BCL/library interfaces (IDisposable, ILogger, IOptionsMonitor, IAsyncLifetime) - reword the last 5 src/ false positives (CWE-1236, failures-1, year-0001, M365) Only non-comment edits: four one-line nested classes split across lines so members can carry docs. Build 0 errors / 0 warnings.
91 lines
6.0 KiB
C#
91 lines
6.0 KiB
C#
using System.Reflection;
|
|
using Microsoft.AspNetCore.Authorization;
|
|
using Microsoft.AspNetCore.Components;
|
|
using ZB.MOM.WW.ScadaBridge.CentralUI.Components.Layout;
|
|
using ZB.MOM.WW.ScadaBridge.Security;
|
|
|
|
namespace ZB.MOM.WW.ScadaBridge.CentralUI.Tests.Auth;
|
|
|
|
public class RoutePolicyCoverageTests
|
|
{
|
|
/// <summary>Verifies that every routable component has its reviewed authorization policy, including the external secrets pages.</summary>
|
|
[Fact]
|
|
public void EveryRoutableComponent_HasItsReviewedPolicy_IncludingExternalSecrets()
|
|
{
|
|
var expected = new Dictionary<string, string>
|
|
{
|
|
["/"] = "authenticated",
|
|
["/admin/api-keys"] = AuthorizationPolicies.RequireAdmin,
|
|
["/admin/api-keys/create"] = AuthorizationPolicies.RequireAdmin,
|
|
["/admin/api-keys/{KeyId}/edit"] = AuthorizationPolicies.RequireAdmin,
|
|
["/admin/ldap-mappings"] = AuthorizationPolicies.RequireAdmin,
|
|
["/admin/ldap-mappings/create"] = AuthorizationPolicies.RequireAdmin,
|
|
["/admin/ldap-mappings/{Id:int}/edit"] = AuthorizationPolicies.RequireAdmin,
|
|
["/admin/sites"] = AuthorizationPolicies.RequireAdmin,
|
|
["/admin/sites/create"] = AuthorizationPolicies.RequireAdmin,
|
|
["/admin/sites/{Id:int}/edit"] = AuthorizationPolicies.RequireAdmin,
|
|
["/audit/configuration"] = AuthorizationPolicies.OperationalAudit,
|
|
["/audit/execution-tree"] = AuthorizationPolicies.OperationalAudit,
|
|
["/audit/log"] = AuthorizationPolicies.OperationalAudit,
|
|
["/deployment/debug-view"] = AuthorizationPolicies.RequireDeployment,
|
|
["/deployment/deployments"] = AuthorizationPolicies.RequireDeployment,
|
|
["/deployment/flow-debugger"] = AuthorizationPolicies.RequireFlowDebugger,
|
|
["/deployment/instances"] = AuthorizationPolicies.RequireDeployment,
|
|
["/deployment/instances/create"] = AuthorizationPolicies.RequireDeployment,
|
|
["/deployment/instances/{Id:int}/configure"] = AuthorizationPolicies.RequireDeployment,
|
|
["/deployment/topology"] = AuthorizationPolicies.RequireDeployment,
|
|
["/design/api-methods/create"] = AuthorizationPolicies.RequireDesign,
|
|
["/design/api-methods/{Id:int}/edit"] = AuthorizationPolicies.RequireDesign,
|
|
["/design/connections"] = AuthorizationPolicies.RequireDesign,
|
|
["/design/connections/create"] = AuthorizationPolicies.RequireDesign,
|
|
["/design/connections/{Id:int}/certificates"] = AuthorizationPolicies.RequireAdmin,
|
|
["/design/connections/{Id:int}/edit"] = AuthorizationPolicies.RequireDesign,
|
|
["/design/data-connections"] = AuthorizationPolicies.RequireDesign,
|
|
["/design/data-connections/create"] = AuthorizationPolicies.RequireDesign,
|
|
["/design/data-connections/{Id:int}/edit"] = AuthorizationPolicies.RequireDesign,
|
|
["/design/db-connections/create"] = AuthorizationPolicies.RequireDesign,
|
|
["/design/db-connections/{Id:int}/edit"] = AuthorizationPolicies.RequireDesign,
|
|
["/design/external-systems"] = AuthorizationPolicies.RequireDesign,
|
|
["/design/external-systems/create"] = AuthorizationPolicies.RequireDesign,
|
|
["/design/external-systems/{Id:int}/edit"] = AuthorizationPolicies.RequireDesign,
|
|
["/design/schema-library"] = AuthorizationPolicies.RequireDesign,
|
|
["/design/shared-scripts"] = AuthorizationPolicies.RequireDesign,
|
|
["/design/shared-scripts/create"] = AuthorizationPolicies.RequireDesign,
|
|
["/design/shared-scripts/{Id:int}/edit"] = AuthorizationPolicies.RequireDesign,
|
|
["/design/templates"] = AuthorizationPolicies.RequireDesign,
|
|
["/design/templates/create"] = AuthorizationPolicies.RequireDesign,
|
|
["/design/templates/{Id:int}"] = AuthorizationPolicies.RequireDesign,
|
|
["/design/transport/export"] = AuthorizationPolicies.RequireDesign,
|
|
["/design/transport/import"] = AuthorizationPolicies.RequireAdmin,
|
|
["/login"] = "anonymous",
|
|
["/monitoring/alarms"] = AuthorizationPolicies.RequireDeployment,
|
|
["/monitoring/event-logs"] = AuthorizationPolicies.RequireDeployment,
|
|
["/monitoring/health"] = "authenticated",
|
|
["/monitoring/parked-messages"] = AuthorizationPolicies.RequireDeployment,
|
|
["/notifications/kpis"] = AuthorizationPolicies.RequireDeployment,
|
|
["/notifications/lists"] = AuthorizationPolicies.RequireDesign,
|
|
["/notifications/lists/create"] = AuthorizationPolicies.RequireDesign,
|
|
["/notifications/lists/{Id:int}/edit"] = AuthorizationPolicies.RequireDesign,
|
|
["/notifications/report"] = AuthorizationPolicies.RequireDeployment,
|
|
["/notifications/sms"] = AuthorizationPolicies.RequireAdmin,
|
|
["/notifications/smtp"] = AuthorizationPolicies.RequireAdmin,
|
|
["/operations/secured-writes"] = AuthorizationPolicies.RequireSecuredWriteAccess,
|
|
["/site-calls/report"] = AuthorizationPolicies.RequireDeployment,
|
|
["/admin/secrets"] = "secrets:manage",
|
|
};
|
|
var actual = new Dictionary<string, string>();
|
|
foreach (var type in new[] { typeof(MainLayout).Assembly, typeof(ZB.MOM.WW.Secrets.Ui.SecretsPage).Assembly }
|
|
.SelectMany(a => a.GetTypes()))
|
|
{
|
|
foreach (var route in type.GetCustomAttributes<RouteAttribute>())
|
|
{
|
|
var anonymous = type.IsDefined(typeof(AllowAnonymousAttribute));
|
|
var authorization = type.GetCustomAttributes<AuthorizeAttribute>().ToArray();
|
|
Assert.True(anonymous || authorization.Length > 0, $"Missing authorization: {route.Template}");
|
|
actual.Add(route.Template, anonymous ? "anonymous" : Assert.Single(authorization).Policy ?? "authenticated");
|
|
}
|
|
}
|
|
Assert.Equal(expected.OrderBy(x => x.Key), actual.OrderBy(x => x.Key));
|
|
}
|
|
}
|