Joseph Doherty
513fa1aa16
Comment/XML-doc changes only: - add summaries to ~10k test methods, fixtures, fakes and helpers (+ <param> on theories, <returns> on async Task methods, <inheritdoc/> on interface implementations the checker can resolve) - strip ~2.6k project-tracking references (WP*, P*-*, row-NN, Task N, #NN, Component-0NN) from comments, keeping the explanatory text; reword false positives in comments only - real docs on fakes implementing BCL/library interfaces (IDisposable, ILogger, IOptionsMonitor, IAsyncLifetime) - reword the last 5 src/ false positives (CWE-1236, failures-1, year-0001, M365) Only non-comment edits: four one-line nested classes split across lines so members can carry docs. Build 0 errors / 0 warnings.
56 lines
2.1 KiB
C#
56 lines
2.1 KiB
C#
using Microsoft.AspNetCore.Authorization;
|
|
using ZB.MOM.WW.ScadaBridge.CentralUI.Components.Pages.Monitoring;
|
|
using ZB.MOM.WW.ScadaBridge.Security;
|
|
|
|
namespace ZB.MOM.WW.ScadaBridge.CentralUI.Tests.Monitoring;
|
|
|
|
/// <summary>
|
|
/// Regression tests for page authorization. The design doc classifies the Site Event
|
|
/// Log Viewer and Parked Message Management as <b>Deployment Role</b>, but both
|
|
/// pages were annotated only <c>[Authorize]</c> (any authenticated user) — a
|
|
/// non-Deployment user who followed the nav link could query event logs and
|
|
/// retry/discard parked messages. The Health Dashboard is intentionally
|
|
/// all-roles per the design.
|
|
/// </summary>
|
|
public class MonitoringAuthorizationTests
|
|
{
|
|
private static AuthorizeAttribute? AuthorizeOf<TPage>()
|
|
=> typeof(TPage)
|
|
.GetCustomAttributes(typeof(AuthorizeAttribute), true)
|
|
.Cast<AuthorizeAttribute>()
|
|
.FirstOrDefault();
|
|
|
|
/// <summary>Verifies that the event logs page requires the Deployment authorization policy.</summary>
|
|
[Fact]
|
|
public void EventLogsPage_RequiresDeploymentPolicy()
|
|
{
|
|
var attr = AuthorizeOf<EventLogs>();
|
|
|
|
Assert.NotNull(attr);
|
|
Assert.Equal(AuthorizationPolicies.RequireDeployment, attr!.Policy);
|
|
}
|
|
|
|
/// <summary>Verifies that the parked messages page requires the Deployment authorization policy.</summary>
|
|
[Fact]
|
|
public void ParkedMessagesPage_RequiresDeploymentPolicy()
|
|
{
|
|
var attr = AuthorizeOf<ParkedMessages>();
|
|
|
|
Assert.NotNull(attr);
|
|
Assert.Equal(AuthorizationPolicies.RequireDeployment, attr!.Policy);
|
|
}
|
|
|
|
/// <summary>Verifies that the health dashboard is intentionally open to all authenticated roles.</summary>
|
|
[Fact]
|
|
public void HealthDashboard_IsIntentionallyAllAuthenticatedRoles()
|
|
{
|
|
// Health Dashboard stays all-roles (no policy) per the design doc.
|
|
// Fully qualified: the Communication.Health namespace otherwise makes
|
|
// the bare `Health` page type ambiguous.
|
|
var attr = AuthorizeOf<CentralUI.Components.Pages.Monitoring.Health>();
|
|
|
|
Assert.NotNull(attr);
|
|
Assert.Null(attr!.Policy);
|
|
}
|
|
}
|