dohertj2/lmxopcua
1
0
Fork 0
Code Issues 1 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix(server): wire PermissionTrieCache into AuthorizationGate for generation pinning

Browse Source 
Core-002 fixed TriePermissionEvaluator to evaluate each request against
the session's bound AuthGenerationId rather than whatever the cache
currently holds. AuthorizationGate.BuildSessionState was not updated at
the same time: it hardcoded AuthGenerationId = 0, so the evaluator's
GetTrie(cluster, 0) call returned null for any generation != 0, causing
every gated operation to silently fail with NotGranted regardless of
actual grants. The 42 gate/matrix/deferred-hardening tests all started
failing as a result.

Fix: add an optional PermissionTrieCache parameter to AuthorizationGate;
BuildSessionState now stamps AuthGenerationId from the cache's current
generation for the session's cluster. AuthorizationBootstrap.BuildGateAsync
passes the cache it creates. All 7 test MakeGate helpers updated to pass
the cache so tests produce a valid AuthGenerationId. 433/433 server tests
now pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Joseph Doherty
2026-05-22 11:25:39 -04:00
parent 7bf2dc49cf
commit 0f3b74ad87
9 changed files with 49 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
tests/Server/ZB.MOM.WW.OtOpcUa.Server.Tests/AuthorizationGateTests.cs
View File

@@ -40,7 +40,8 @@ public sealed class AuthorizationGateTests
var cache = new PermissionTrieCache();
cache.Install(PermissionTrieBuilder.Build("c1", 1, rows));
var evaluator = new TriePermissionEvaluator(cache);
return new AuthorizationGate(evaluator, strictMode: strict);
// Pass the cache so BuildSessionState stamps AuthGenerationId = 1 (Core-002 fix).
return new AuthorizationGate(evaluator, strictMode: strict, trieCache: cache);
}
private sealed class FakeIdentity : UserIdentity, ILdapGroupsBearer

2
tests/Server/ZB.MOM.WW.OtOpcUa.Server.Tests/BrowseGatingTests.cs
View File

@@ -141,7 +141,7 @@ public sealed class BrowseGatingTests
var cache = new PermissionTrieCache();
cache.Install(PermissionTrieBuilder.Build("c1", 1, rows));
var evaluator = new TriePermissionEvaluator(cache);
return new AuthorizationGate(evaluator, strictMode: strict);
return new AuthorizationGate(evaluator, strictMode: strict, trieCache: cache);
}
private static IUserIdentity NewIdentity(string name, params string[] groups) => new FakeIdentity(name, groups);

2
tests/Server/ZB.MOM.WW.OtOpcUa.Server.Tests/CallGatingTests.cs
View File

@@ -209,7 +209,7 @@ public sealed class CallGatingTests
var cache = new PermissionTrieCache();
cache.Install(PermissionTrieBuilder.Build("c1", 1, rows));
var evaluator = new TriePermissionEvaluator(cache);
return new AuthorizationGate(evaluator, strictMode: strict);
return new AuthorizationGate(evaluator, strictMode: strict, trieCache: cache);
}
private static IUserIdentity NewIdentity(string name, params string[] groups) => new FakeIdentity(name, groups);

2
tests/Server/ZB.MOM.WW.OtOpcUa.Server.Tests/DeferredGateHardeningTests.cs
View File

@@ -375,7 +375,7 @@ public sealed class DeferredGateHardeningTests
var cache = new PermissionTrieCache();
cache.Install(PermissionTrieBuilder.Build(Cluster, 1, rows));
var evaluator = new TriePermissionEvaluator(cache);
return new AuthorizationGate(evaluator, strictMode: strict);
return new AuthorizationGate(evaluator, strictMode: strict, trieCache: cache);
}
private static IUserIdentity NewIdentity(string name, params string[] groups) => new FakeIdentity(name, groups);

2
tests/Server/ZB.MOM.WW.OtOpcUa.Server.Tests/EquipmentIdentificationAuthzTests.cs
View File

@@ -118,7 +118,7 @@ public sealed class EquipmentIdentificationAuthzTests
var cache = new PermissionTrieCache();
cache.Install(PermissionTrieBuilder.Build(Cluster, 1, [aclRow], paths));
var evaluator = new TriePermissionEvaluator(cache);
var gate = new AuthorizationGate(evaluator, strictMode: true);
var gate = new AuthorizationGate(evaluator, strictMode: true, trieCache: cache);
_ = content;
return (gate, resolver);

2
tests/Server/ZB.MOM.WW.OtOpcUa.Server.Tests/MonitoredItemGatingTests.cs
View File

@@ -128,7 +128,7 @@ public sealed class MonitoredItemGatingTests
var cache = new PermissionTrieCache();
cache.Install(PermissionTrieBuilder.Build("c1", 1, rows));
var evaluator = new TriePermissionEvaluator(cache);
return new AuthorizationGate(evaluator, strictMode: strict);
return new AuthorizationGate(evaluator, strictMode: strict, trieCache: cache);
}
private static IUserIdentity NewIdentity(string name, params string[] groups) => new FakeIdentity(name, groups);

2
tests/Server/ZB.MOM.WW.OtOpcUa.Server.Tests/ThreeUserInteropMatrixTests.cs
View File

@@ -122,7 +122,7 @@ public sealed class ThreeUserInteropMatrixTests
{
var cache = new PermissionTrieCache();
cache.Install(PermissionTrieBuilder.Build(ClusterId, 1, AclMatrix()));
return new AuthorizationGate(new TriePermissionEvaluator(cache), strictMode: true);
return new AuthorizationGate(new TriePermissionEvaluator(cache), strictMode: true, trieCache: cache);
}
private sealed class LdapBoundIdentity : UserIdentity, ILdapGroupsBearer