feat(acl): API key minting — AdminUI page + admin service (#520)
Pulled forward from stage 7 because without it the feature is unusable and un-live-gateable: there was no way to create a key short of hand-inserting a row and computing an HMAC by hand. The minting logic is an IApiKeyAdminService in Core.Authorization, NOT logic in the Razor page — this repo has no bUnit, so anything only a page can reach is untestable, and minting credentials is not where that belongs. The page is a thin shell over it. Moved to Core.Authorization so both ends can reach them: ApiKeyOptions (was in Host) and OpcUaPrincipals (was in OpcUaServer.Security). The OPC UA server resolves principals; the AdminUI must refuse to mint a key claiming a reserved one. OpcUaServer already gained a Core reference in stage 1b, so no new edge — AdminUI gains one. ApiKeyOptions is now bound UNCONDITIONALLY rather than in the driver branch: a driver node needs the pepper to VERIFY keys and an admin node needs it to MINT them, and getting that wrong on either side is a silent authentication failure rather than a startup error. Validation rules, all covered: the reserved 'anonymous' principal is refused case-insensitively (so "ANONYMOUS" cannot slip past into a distinct principal that the evaluator would then match case-INsensitively against anonymous's grants); blank name/principal; a principal longer than the column, rejected rather than truncated, because silent truncation yields a key that authenticates and is granted nothing with no visible cause; a past expiry. Generation runs BEFORE the DbContext is opened so an unconfigured pepper surfaces as a clear error instead of a stored row whose hash nothing can verify. The page shows the plaintext ONCE and says so; it is held in component state and written nowhere else, because the server keeps only a hash. Revocation is flagged in the UI as taking effect only after the next deployment — driver-only nodes have no ConfigDb, so keys ride the artifact. FleetAdmin-only (Administrator), not ConfigEditor: this mints credentials. Core.Tests 68 green. Claude-Session: https://claude.ai/code/session_015p7wGqy3YpZNCpDzTpGMKo
This commit is contained in:
Joseph Doherty
@@ -20,6 +20,7 @@
|
||||
<NavRailItem Href="/reservations" Text="Reservations" />
|
||||
<NavRailItem Href="/certificates" Text="Certificates" />
|
||||
<NavRailItem Href="/role-grants" Text="Role grants" />
|
||||
<NavRailItem Href="/apikeys" Text="API keys" />
|
||||
<NavRailItem Href="/admin/secrets" Text="Secrets" />
|
||||
</NavRailSection>
|
||||
<NavRailSection Title="Scripting" Key="scripting">
|
||||
|
||||
@@ -0,0 +1,206 @@
|
||||
@page "/apikeys"
|
||||
@attribute [Authorize(Policy = AdminUiPolicies.FleetAdmin)]
|
||||
@rendermode RenderMode.InteractiveServer
|
||||
@using ZB.MOM.WW.OtOpcUa.Configuration.Entities
|
||||
@using ZB.MOM.WW.OtOpcUa.Core.Authorization
|
||||
@inject IApiKeyAdminService Keys
|
||||
|
||||
<div class="d-flex justify-content-between align-items-center mb-3">
|
||||
<h4 class="mb-0">OPC UA API keys</h4>
|
||||
</div>
|
||||
|
||||
<div class="alert alert-info" role="alert">
|
||||
The OPC UA data plane is machine-to-machine. A client connects with an OPC UA
|
||||
<strong>UserName</strong> token whose username is the literal <span class="mono">apikey</span> and
|
||||
whose password is the key below. The key resolves to a <strong>principal</strong>; ACL rows naming
|
||||
that principal are what grant it permissions.
|
||||
<br />
|
||||
<strong>Revoking a key takes effect on a node only after the next deployment</strong> — driver-only
|
||||
nodes have no config database, so keys travel inside the deployment artifact.
|
||||
</div>
|
||||
|
||||
@if (_created is not null)
|
||||
{
|
||||
<div class="alert alert-success" role="alert">
|
||||
<strong>Copy this key now — it is not stored and cannot be shown again.</strong>
|
||||
<pre class="mono mt-2 mb-0" style="white-space:pre-wrap;word-break:break-all">@_created</pre>
|
||||
<button class="btn btn-sm btn-secondary mt-2" @onclick="() => _created = null">Dismiss</button>
|
||||
</div>
|
||||
}
|
||||
|
||||
@if (!string.IsNullOrWhiteSpace(_error))
|
||||
{
|
||||
<div class="alert alert-danger" role="alert">@_error</div>
|
||||
}
|
||||
|
||||
<section class="panel mb-3">
|
||||
<div class="panel-head">Create a key</div>
|
||||
<div style="padding:1rem">
|
||||
<div class="row g-2">
|
||||
<div class="col-md-3">
|
||||
<label class="form-label" for="k-name">Name</label>
|
||||
<input id="k-name" class="form-control form-control-sm" @bind="_newName"
|
||||
placeholder="ScadaBridge DCL" />
|
||||
</div>
|
||||
<div class="col-md-3">
|
||||
<label class="form-label" for="k-principal">Principal</label>
|
||||
<input id="k-principal" class="form-control form-control-sm mono" @bind="_newPrincipal"
|
||||
placeholder="scadabridge-dcl" />
|
||||
</div>
|
||||
<div class="col-md-3">
|
||||
<label class="form-label" for="k-expires">Expires (optional, UTC)</label>
|
||||
<input id="k-expires" type="date" class="form-control form-control-sm" @bind="_newExpires" />
|
||||
</div>
|
||||
<div class="col-md-3 d-flex align-items-end">
|
||||
<button class="btn btn-sm btn-primary" @onclick="CreateAsync" disabled="@_busy">Create key</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</section>
|
||||
|
||||
<section class="panel">
|
||||
<div class="panel-head">Keys</div>
|
||||
@if (_keys is null)
|
||||
{
|
||||
<div style="padding:1rem" class="text-muted">Loading…</div>
|
||||
}
|
||||
else if (_keys.Count == 0)
|
||||
{
|
||||
<div style="padding:1rem" class="text-muted">
|
||||
No keys yet. Until one exists, only anonymous sessions can connect.
|
||||
</div>
|
||||
}
|
||||
else
|
||||
{
|
||||
<table class="table table-sm mb-0">
|
||||
<thead>
|
||||
<tr>
|
||||
<th>Name</th>
|
||||
<th>Principal</th>
|
||||
<th>Key id</th>
|
||||
<th>Status</th>
|
||||
<th>Created (UTC)</th>
|
||||
<th>Expires (UTC)</th>
|
||||
<th></th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
@foreach (var k in _keys)
|
||||
{
|
||||
<tr>
|
||||
<td>@k.Name</td>
|
||||
<td><span class="mono">@k.Principal</span></td>
|
||||
<td><span class="mono">@k.ApiKeyId</span></td>
|
||||
<td>
|
||||
@if (!k.Enabled)
|
||||
{
|
||||
<span class="badge bg-secondary">revoked</span>
|
||||
}
|
||||
else if (k.ExpiresUtc is { } e && e <= DateTime.UtcNow)
|
||||
{
|
||||
<span class="badge bg-warning text-dark">expired</span>
|
||||
}
|
||||
else
|
||||
{
|
||||
<span class="badge bg-success">active</span>
|
||||
}
|
||||
</td>
|
||||
<td>@k.CreatedUtc.ToString("yyyy-MM-dd HH:mm")</td>
|
||||
<td>@(k.ExpiresUtc?.ToString("yyyy-MM-dd") ?? "—")</td>
|
||||
<td class="text-end">
|
||||
<button class="btn btn-sm btn-outline-secondary"
|
||||
@onclick="() => SetEnabledAsync(k.ApiKeyId, !k.Enabled)" disabled="@_busy">
|
||||
@(k.Enabled ? "Revoke" : "Re-enable")
|
||||
</button>
|
||||
<button class="btn btn-sm btn-outline-danger"
|
||||
@onclick="() => DeleteAsync(k.ApiKeyId)" disabled="@_busy">Delete</button>
|
||||
</td>
|
||||
</tr>
|
||||
}
|
||||
</tbody>
|
||||
</table>
|
||||
}
|
||||
</section>
|
||||
|
||||
@code {
|
||||
private IReadOnlyList<ApiKey>? _keys;
|
||||
private string _newName = "";
|
||||
private string _newPrincipal = "";
|
||||
private DateTime? _newExpires;
|
||||
private string? _created;
|
||||
private string? _error;
|
||||
private bool _busy;
|
||||
|
||||
protected override async Task OnInitializedAsync() => await ReloadAsync();
|
||||
|
||||
private async Task ReloadAsync()
|
||||
{
|
||||
try
|
||||
{
|
||||
_keys = await Keys.ListAsync(default);
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
_error = ex.Message;
|
||||
_keys = [];
|
||||
}
|
||||
}
|
||||
|
||||
private async Task CreateAsync()
|
||||
{
|
||||
_busy = true;
|
||||
_error = null;
|
||||
_created = null;
|
||||
try
|
||||
{
|
||||
// Shown once, held only in this component's state. There is no way to recover it afterwards
|
||||
// — the server stores a hash — so it is deliberately not written anywhere else.
|
||||
_created = await Keys.CreateAsync(
|
||||
_newName,
|
||||
_newPrincipal,
|
||||
// A date-only input means midnight; treat it as UTC rather than local so an operator
|
||||
// near a timezone boundary does not get a key that expired before it was issued.
|
||||
_newExpires is { } d ? DateTime.SpecifyKind(d, DateTimeKind.Utc) : null,
|
||||
notes: null,
|
||||
default);
|
||||
_newName = "";
|
||||
_newPrincipal = "";
|
||||
_newExpires = null;
|
||||
await ReloadAsync();
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
_error = ex.Message;
|
||||
}
|
||||
finally
|
||||
{
|
||||
_busy = false;
|
||||
}
|
||||
}
|
||||
|
||||
private async Task SetEnabledAsync(string apiKeyId, bool enabled)
|
||||
{
|
||||
_busy = true;
|
||||
_error = null;
|
||||
try
|
||||
{
|
||||
await Keys.SetEnabledAsync(apiKeyId, enabled, default);
|
||||
await ReloadAsync();
|
||||
}
|
||||
catch (Exception ex) { _error = ex.Message; }
|
||||
finally { _busy = false; }
|
||||
}
|
||||
|
||||
private async Task DeleteAsync(string apiKeyId)
|
||||
{
|
||||
_busy = true;
|
||||
_error = null;
|
||||
try
|
||||
{
|
||||
await Keys.DeleteAsync(apiKeyId, default);
|
||||
await ReloadAsync();
|
||||
}
|
||||
catch (Exception ex) { _error = ex.Message; }
|
||||
finally { _busy = false; }
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user