Joseph Doherty
9cff87fe85
Remove project bookkeeping citations from shipped code comments across the solution: hyphenated task IDs (WP-14, StoreAndForward-025), milestone/task/ issue refs (M3, Task 4, Audit Log #23, #21), Bundle X task-bundle labels, and C/D/K/S/T phase labels. Comment text only — no code logic, string/log literals, or XML-doc structure changed. Genuine descriptions are preserved (only the citation is stripped), and technical lookalikes are retained (UTF-8, SHA-256, T00:00:00, M365, UTC-5, pre-C4/pre-C5 schema versions). Flagged by the new CommentChecker TaskReferenceInComment / TrackingReferenceInComment checks plus targeted grep passes; full solution builds clean, append-only guard tests pass.
38 lines
1.8 KiB
C#
38 lines
1.8 KiB
C#
namespace ZB.MOM.WW.ScadaBridge.InboundAPI;
|
|
|
|
public class InboundApiOptions
|
|
{
|
|
/// <summary>
|
|
/// Default cap on the inbound API request body, in bytes.
|
|
/// </summary>
|
|
public const long DefaultMaxRequestBodyBytes = 1L * 1024 * 1024; // 1 MiB
|
|
|
|
/// <summary>Default timeout for inbound API method execution before the request is cancelled.</summary>
|
|
public TimeSpan DefaultMethodTimeout { get; set; } = TimeSpan.FromSeconds(30);
|
|
|
|
/// <summary>
|
|
/// Maximum accepted request body size for <c>POST /api/{methodName}</c>.
|
|
/// Requests whose body exceeds this are rejected with HTTP 413 before being
|
|
/// buffered into a <see cref="System.Text.Json.JsonDocument"/>. The inbound API
|
|
/// has no rate limiting (a deliberate design choice), so an explicit, modest cap
|
|
/// bounds per-request allocations.
|
|
/// </summary>
|
|
public long MaxRequestBodyBytes { get; set; } = DefaultMaxRequestBodyBytes;
|
|
|
|
/// <summary>
|
|
/// Server-side HMAC pepper for inbound-API bearer credentials, bound from
|
|
/// <c>ScadaBridge:InboundApi:ApiKeyPepper</c>.
|
|
/// <para>
|
|
/// Auth re-arch: the legacy SQL Server hashing path that consumed this
|
|
/// property was retired. The pepper itself is still required — the shared
|
|
/// ZB.MOM.WW.Auth.ApiKeys verifier reads the SAME configuration key
|
|
/// (<c>PepperSecretName</c> in the Host composition root points at it) to pepper
|
|
/// the SQLite-stored keys. It is a secret: supply a strong, random value
|
|
/// (≥ 16 characters), DIFFERENT per environment, via a secret store and never
|
|
/// hard-coded. This property is retained so the section still binds cleanly; the
|
|
/// value is consumed by the library verifier, not by <c>AddInboundAPI</c>.
|
|
/// </para>
|
|
/// </summary>
|
|
public string ApiKeyPepper { get; set; } = string.Empty;
|
|
}
|