Joseph Doherty
b104760b3a
Standardize role string VALUES on the canonical vocabulary
(Administrator/Designer/Deployer/Viewer; Operator/Engineer unused here):
Admin -> Administrator
Design -> Designer
Deployment -> Deployer
Audit -> Administrator (COLLAPSE; accepted privilege escalation)
AuditReadOnly-> Viewer (COLLAPSE; keeps audit-read, no export)
SoD: OperationalAuditRoles = { Administrator, Viewer },
AuditExportRoles = { Administrator }
so Viewer reads the audit log + nav but cannot bulk-export, while
Administrator does both + holds the full admin surface (the documented,
accepted auditor/admin SoD collapse).
Atomic move across every enforcement site:
- Roles constants; AuthorizationPolicies (RequireClaim values + SoD arrays +
honest XML-doc); RoleMapper Deployer check.
- ManagementActor.GetRequiredRole switch + the hard-coded site-scope
admin-bypass (now Roles.Administrator at all 6 sites). Site-scoping logic
is otherwise unchanged.
- DebugStreamHub Administrator/Deployer gates (Deployer kept case-sensitive).
- CentralUI BrowseService/BindingTester Designer guards; LdapMappingForm
dropdown now offers canonical values (incl. Viewer).
- Config-DB seed (LdapGroupMappings Id 1-4) + EF migration CanonicalizeRoles:
Id-keyed UpdateData for seed rows + idempotent raw catch-all UPDATEs for
operator-added rows. Down is lossy on the collapse (documented in-file).
No pending model changes.
Tests reworked to the collapsed model across Security/CentralUI/
ManagementService/ConfigurationDatabase/Integration suites, incl. explicit
Viewer-reads-not-exports and former-Audit-now-Administrator-escalation cases.
CHANGELOG: BREAKING security note documenting the canonicalization + SoD
collapse.
67 lines
1.9 KiB
C#
67 lines
1.9 KiB
C#
using ZB.MOM.WW.ScadaBridge.ManagementService;
|
|
|
|
namespace ZB.MOM.WW.ScadaBridge.ManagementService.Tests;
|
|
|
|
/// <summary>
|
|
/// Tests for <see cref="DebugStreamHub"/> per-instance site-scope authorization
|
|
/// (finding ManagementService-003).
|
|
/// </summary>
|
|
public class DebugStreamHubTests
|
|
{
|
|
[Fact]
|
|
public void IsInstanceAccessAllowed_SiteScopedUser_InScopeInstance_Allowed()
|
|
{
|
|
var allowed = DebugStreamHub.IsInstanceAccessAllowed(
|
|
roles: new[] { "Deployer" },
|
|
permittedSiteIds: new[] { "1", "2" },
|
|
instanceSiteId: 2);
|
|
|
|
Assert.True(allowed);
|
|
}
|
|
|
|
[Fact]
|
|
public void IsInstanceAccessAllowed_SiteScopedUser_OutOfScopeInstance_Denied()
|
|
{
|
|
var allowed = DebugStreamHub.IsInstanceAccessAllowed(
|
|
roles: new[] { "Deployer" },
|
|
permittedSiteIds: new[] { "1", "2" },
|
|
instanceSiteId: 99);
|
|
|
|
Assert.False(allowed);
|
|
}
|
|
|
|
[Fact]
|
|
public void IsInstanceAccessAllowed_SystemWideDeployment_AnySiteAllowed()
|
|
{
|
|
// Empty permitted set == system-wide Deployer.
|
|
var allowed = DebugStreamHub.IsInstanceAccessAllowed(
|
|
roles: new[] { "Deployer" },
|
|
permittedSiteIds: Array.Empty<string>(),
|
|
instanceSiteId: 99);
|
|
|
|
Assert.True(allowed);
|
|
}
|
|
|
|
[Fact]
|
|
public void IsInstanceAccessAllowed_AdminRole_BypassesSiteScope()
|
|
{
|
|
var allowed = DebugStreamHub.IsInstanceAccessAllowed(
|
|
roles: new[] { "Administrator", "Deployer" },
|
|
permittedSiteIds: new[] { "1" },
|
|
instanceSiteId: 99);
|
|
|
|
Assert.True(allowed);
|
|
}
|
|
|
|
[Fact]
|
|
public void IsInstanceAccessAllowed_AdminRoleCheck_IsCaseInsensitive()
|
|
{
|
|
var allowed = DebugStreamHub.IsInstanceAccessAllowed(
|
|
roles: new[] { "administrator" },
|
|
permittedSiteIds: new[] { "1" },
|
|
instanceSiteId: 99);
|
|
|
|
Assert.True(allowed);
|
|
}
|
|
}
|