feat(auth): cut OtOpcUa over to ZB.MOM.WW.Auth.Ldap; preserve DevStubMode; route roles via IGroupRoleMapper (Task 1.2/1.4)

src/Server/ZB.MOM.WW.OtOpcUa.Host/Configuration/LdapOptionsValidator.cs

@@ -10,7 +10,10 @@ namespace ZB.MOM.WW.OtOpcUa.Host.Configuration;
 ///     TCP port; when disabled — or when <c>DevStubMode</c> bypasses the real bind — all checks are
 ///     skipped. <c>ServiceAccountDn</c>/<c>Password</c> are
 ///     intentionally not required — an empty pair selects the direct-bind path (see
-///     <see cref="LdapOptions.ServiceAccountDn"/>). Failure messages use <c>"Ldap:"</c> as a
+///     <see cref="LdapOptions.ServiceAccountDn"/>). The plaintext-transport-without-AllowInsecure
+///     guard is enforced at the auth boundary (<see cref="OtOpcUaLdapAuthService"/>) rather than here,
+///     to preserve the bespoke service's behaviour of booting and failing closed at login (not at
+///     startup) when a config selects insecure transport. Failure messages use <c>"Ldap:"</c> as a
 ///     human-readable field prefix — not the literal bound section path, which is
 ///     <c>Security:Ldap</c> (see <see cref="LdapOptions.SectionName"/>).
 /// </summary>

src/Server/ZB.MOM.WW.OtOpcUa.Host/OpcUa/LdapOpcUaUserAuthenticator.cs

@@ -1,4 +1,6 @@
+using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Logging;
+using ZB.MOM.WW.Auth.Abstractions.Roles;
 using ZB.MOM.WW.OtOpcUa.OpcUaServer.Security;
 using ZB.MOM.WW.OtOpcUa.Security.Ldap;
 
@@ -8,15 +10,23 @@ namespace ZB.MOM.WW.OtOpcUa.Host.OpcUa;
 /// Production <see cref="IOpcUaUserAuthenticator"/> adapter that bridges OPC UA UserName
 /// tokens to the same <see cref="ILdapAuthService"/> the Admin UI cookie/JWT flows use, so a
 /// single LDAP source-of-truth governs both control-plane (Admin) and data-plane (OPC UA)
-/// session identities. Roles flow through unchanged — the data-plane ACL evaluator reads
-/// them off <c>OperationContext.UserIdentity</c> downstream.
+/// session identities. Roles are resolved through the shared
+/// <see cref="IGroupRoleMapper{TRole}"/> seam from the LDAP groups returned by the directory —
+/// the same seam the login endpoint uses — and the resolved set is attached to the OPC UA
+/// session identity for the downstream data-plane ACL evaluator.
 /// </summary>
+/// <remarks>
+/// This authenticator is registered as a singleton, but <see cref="IGroupRoleMapper{TRole}"/>
+/// (and its DbContext-backed mapping service) is scoped. A per-call DI scope is opened to
+/// resolve the mapper so the singleton never captures a scoped dependency.
+/// </remarks>
 public sealed class LdapOpcUaUserAuthenticator(
     ILdapAuthService ldap,
+    IServiceScopeFactory scopeFactory,
     ILogger<LdapOpcUaUserAuthenticator> logger)
     : IOpcUaUserAuthenticator
 {
-    /// <summary>Authenticates an OPC UA UserName token via LDAP.</summary>
+    /// <summary>Authenticates an OPC UA UserName token via LDAP, resolving roles through the mapper.</summary>
     /// <param name="username">The username to authenticate.</param>
     /// <param name="password">The password to authenticate.</param>
     /// <param name="ct">Cancellation token.</param>
@@ -29,7 +39,9 @@ public sealed class LdapOpcUaUserAuthenticator(
             {
                 return OpcUaUserAuthResult.Deny(result.Error ?? "Invalid credentials");
             }
-            return OpcUaUserAuthResult.Allow(result.DisplayName ?? username, result.Roles);
+
+            var roles = await ResolveRolesAsync(result.Groups, result.Roles, username, ct).ConfigureAwait(false);
+            return OpcUaUserAuthResult.Allow(result.DisplayName ?? username, roles);
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -37,4 +49,36 @@ public sealed class LdapOpcUaUserAuthenticator(
             return OpcUaUserAuthResult.Deny("Authentication backend error");
         }
     }
+
+    /// <summary>
+    /// Resolves the user's roles from their LDAP groups via the scoped
+    /// <see cref="IGroupRoleMapper{TRole}"/>, unioned with any pre-resolved roles (the DevStub
+    /// FleetAdmin grant). A mapper fault (e.g. a DB outage) must not deny an otherwise-authenticated
+    /// session: it falls back to the pre-resolved roles, matching the login endpoint's behaviour.
+    /// </summary>
+    /// <param name="groups">The LDAP groups returned by the directory.</param>
+    /// <param name="preResolved">Pre-resolved roles (empty on the real path; FleetAdmin under DevStub).</param>
+    /// <param name="username">The login name, for diagnostics.</param>
+    /// <param name="ct">Cancellation token.</param>
+    private async Task<IReadOnlyList<string>> ResolveRolesAsync(
+        IReadOnlyList<string> groups, IReadOnlyList<string> preResolved, string username, CancellationToken ct)
+    {
+        try
+        {
+            await using var scope = scopeFactory.CreateAsyncScope();
+            var mapper = scope.ServiceProvider.GetRequiredService<IGroupRoleMapper<string>>();
+            var mapping = await mapper.MapAsync(groups, ct).ConfigureAwait(false);
+
+            var roles = new HashSet<string>(preResolved, StringComparer.OrdinalIgnoreCase);
+            foreach (var role in mapping.Roles)
+                roles.Add(role);
+            return [.. roles];
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            logger.LogWarning(ex,
+                "Role-map lookup failed for OPC UA user {User}; using pre-resolved baseline roles", username);
+            return preResolved;
+        }
+    }
 }

src/Server/ZB.MOM.WW.OtOpcUa.Host/Program.cs

@@ -20,6 +20,7 @@ using ZB.MOM.WW.OtOpcUa.Host.OpcUa;
 using ZB.MOM.WW.OtOpcUa.OpcUaServer;
 using ZB.MOM.WW.OtOpcUa.OpcUaServer.Security;
 using ZB.MOM.WW.OtOpcUa.Runtime;
+using ZB.MOM.WW.Auth.Abstractions.Roles;
 using ZB.MOM.WW.OtOpcUa.Security;
 using ZB.MOM.WW.OtOpcUa.Security.Endpoints;
 using ZB.MOM.WW.OtOpcUa.Security.Ldap;
@@ -101,9 +102,15 @@ if (hasDriver)
     builder.Services.AddSingleton<IScriptedAlarmEvaluator>(sp => sp.GetRequiredService<RoslynScriptedAlarmEvaluator>());
 
     builder.Services.AddValidatedOptions<LdapOptions, LdapOptionsValidator>(builder.Configuration, LdapOptions.SectionName);
-    // TryAdd so a fused admin+driver node (where AddOtOpcUaAuth also registers this) ends up
-    // with exactly one descriptor; on a driver-only node this is the sole registration.
-    builder.Services.TryAddSingleton<ILdapAuthService, LdapAuthService>();
+    // TryAdd so a fused admin+driver node (where AddOtOpcUaAuth also registers these) ends up
+    // with exactly one descriptor; on a driver-only node these are the sole registrations.
+    // OtOpcUaLdapAuthService is the app ILdapAuthService (Enabled switch + DevStubMode over the
+    // shared ZB.MOM.WW.Auth.Ldap service). The data-plane authenticator resolves IGroupRoleMapper
+    // <string> per call to turn the directory's groups into roles, so register it here for driver-
+    // only nodes (AddOtOpcUaAuth registers it on admin nodes); ILdapGroupRoleMappingService it
+    // depends on is already registered unconditionally by AddOtOpcUaConfigDb above.
+    builder.Services.TryAddSingleton<ILdapAuthService, OtOpcUaLdapAuthService>();
+    builder.Services.TryAddScoped<IGroupRoleMapper<string>, OtOpcUaGroupRoleMapper>();
     builder.Services.AddSingleton<IOpcUaUserAuthenticator, LdapOpcUaUserAuthenticator>();
 
     // Bind + validate the OPC UA host options the same way (fail-fast at start via ValidateOnStart)