Joseph Doherty
41 lines
2.0 KiB
C#
41 lines
2.0 KiB
C#
using ZB.MOM.WW.Auth.Abstractions.Roles;
|
|
|
|
namespace ZB.MOM.WW.ScadaBridge.Security;
|
|
|
|
/// <summary>
|
|
/// Adapts ScadaBridge's DB-backed <see cref="RoleMapper"/> to the shared
|
|
/// <see cref="IGroupRoleMapper{TRole}"/> seam from <c>ZB.MOM.WW.Auth.Abstractions</c>.
|
|
/// </summary>
|
|
/// <remarks>
|
|
/// Task 1.1 of the Auth-library adoption: this is an <b>additive</b> wrapper. It does not
|
|
/// re-implement the LDAP-group → role resolution or the site-scope union semantics — it
|
|
/// delegates wholesale to <see cref="RoleMapper.MapGroupsToRolesAsync"/> and re-shapes the
|
|
/// result onto the shared contract. <typeparamref name="TRole"/> is <see cref="string"/>
|
|
/// because ScadaBridge roles travel as plain strings in claims. The full
|
|
/// <see cref="RoleMappingResult"/> — including <see cref="RoleMappingResult.PermittedSiteIds"/>
|
|
/// and <see cref="RoleMappingResult.IsSystemWideDeployment"/> — is carried verbatim in the
|
|
/// mapping's opaque <see cref="GroupRoleMapping{TRole}.Scope"/> so no site-scope information
|
|
/// is lost across the seam. The existing login flow is rewired to consume this in a later task.
|
|
/// </remarks>
|
|
public sealed class ScadaBridgeGroupRoleMapper : IGroupRoleMapper<string>
|
|
{
|
|
private readonly RoleMapper _roleMapper;
|
|
|
|
/// <summary>Initializes the mapper with the wrapped <see cref="RoleMapper"/>.</summary>
|
|
/// <param name="roleMapper">The DB-backed role mapper whose union semantics are reused.</param>
|
|
public ScadaBridgeGroupRoleMapper(RoleMapper roleMapper)
|
|
{
|
|
_roleMapper = roleMapper ?? throw new ArgumentNullException(nameof(roleMapper));
|
|
}
|
|
|
|
/// <inheritdoc />
|
|
public async Task<GroupRoleMapping<string>> MapAsync(IReadOnlyList<string> groups, CancellationToken ct)
|
|
{
|
|
var result = await _roleMapper.MapGroupsToRolesAsync(groups, ct);
|
|
|
|
// Carry the full RoleMappingResult as the opaque Scope so the site-scope
|
|
// payload (PermittedSiteIds + IsSystemWideDeployment) survives the seam.
|
|
return new GroupRoleMapping<string>(result.Roles, Scope: result);
|
|
}
|
|
}
|