feat(acl): variable-depth scope model + the scopePaths producer (#520 stage 3)
Makes the /raw device tree addressable by an ACL rule, and builds the
scope-path producer PermissionTrieBuilder has accepted since it was written
but which had no caller anywhere.
The plan for this stage said "add NodeHierarchyKind.Raw, whose path is the
RawPath segments Folder/Driver/Device/TagGroup/Tag". That shape is wrong.
RawFolder.ParentRawFolderId and TagGroup.ParentTagGroupId are both
self-referencing, so folders and tag groups each nest without bound and a real
RawPath is folder…/Driver/Device/group…/Tag. NodeScope was fixed-arity and
PermissionTrie.CollectMatches was five hardcoded steps, so the scope model
could not address a real raw tree at all. NodeScope is now {ClusterId, Kind,
Segments} and the walk is a segment loop. The trie STRUCTURE was already
variable-depth (NodeAclPath.Segments is a list, Children is a recursive
dictionary), so only the walker and the scope record had to change.
Four decisions worth keeping:
- The namespace level became the realm. Level 1 gated on NodeScope.NamespaceId,
but v3 has no Namespace entity — the snapshot was retired when the address
space went dual-namespace, and the identifier appears nowhere in production
outside NodeScope. So the level could only ever fail to match, which silently
made every sub-cluster grant unreachable while cluster grants kept working.
It is now a realm token derived from the scope's Kind, not carried on it, so
the walk and the producer cannot disagree about its spelling.
- Provenance comes from the granting row's own ScopeKind, recorded on TrieGrant
at build time. Depth-derived provenance could not name a raw level at all,
since the depth of "Device" varies with folder nesting.
- The trie comparer moved from OrdinalIgnoreCase to Ordinal. Raw sibling-name
uniqueness is ordinal, so Speed and speed can both exist under one device and
a grant on either would have matched both.
- The null-scopePaths "deterministic test mode" is deleted. It planted
unresolvable rows at a direct child of the trie root, a position the walker
cannot reach, so the grant looked placed and could never match — and every
test using that mode proved nothing about production placement. scopePaths is
now required, and a row that does not resolve is dropped with a diagnostic.
A scope resolves to a LIST of paths: a raw tag projected into N equipments is
reachable at N+1 NodeIds and a write through any of them lands on the same
driver reference, so a Tag-scoped grant covering only the raw node would be
bypassable through a UNS one. The lookup is keyed on (ScopeKind, ScopeId), not
ScopeId alone — ScopeId has no FK and no type discriminator, so an id collision
across entity types would hand a grant the wrong node's paths.
Also closed here, all found by review rather than asked for:
- NodeAcl rows had no deploy-time validation of any kind and were not reachable
from DraftValidator at all (DraftSnapshot carried no NodeAcls). They are now
gated for dangling ids, cross-cluster scopes, blank/contradictory ScopeId, the
retired FolderSegment kind, and undefined ordinals.
- ConfigDbApiKeyStore conferred roles from Cluster-scoped grants authored in ANY
cluster, because it filtered on scope kind with no ClusterId predicate while
ArtifactApiKeyStore read an already-cluster-filtered snapshot. On a fused
admin+driver node that was a cross-cluster over-grant. Its doc comment claimed
the two stores matched.
- The two AdminUI ACL banners still said enforcement was LDAP-group -> role
mapping, which stages 1/2 made false in both directions.
- The /apikeys page was never classified in PageAuthorizationGuardTests, so that
test has been red since the key-minting commit merged — I did not run
AdminUI.Tests before merging stage 4.
Falsified rather than assumed: 8 mutations against the trie tests, 5 against the
deploy gate (including one proving a cross-cluster row is not silently
mis-diagnosed as unresolved), a staged red->green for the over-grant regression,
and the realm gate, the comparer and the malformed-path guard each broken
individually to confirm only their own tests go red.
Node ACLs are still not ENFORCED — nothing constructs a NodeScope or calls the
evaluator yet. That is stages 5 and 6; this stage makes the model able to
express what those will enforce.
Claude-Session: https://claude.ai/code/session_015p7wGqy3YpZNCpDzTpGMKo
This commit is contained in:
Joseph Doherty
@@ -0,0 +1,270 @@
|
||||
using Shouldly;
|
||||
using Xunit;
|
||||
using ZB.MOM.WW.OtOpcUa.Configuration.Entities;
|
||||
using ZB.MOM.WW.OtOpcUa.Configuration.Enums;
|
||||
using ZB.MOM.WW.OtOpcUa.Core.Authorization;
|
||||
|
||||
namespace ZB.MOM.WW.OtOpcUa.Core.Tests.Authorization;
|
||||
|
||||
/// <summary>
|
||||
/// Coverage for <see cref="AclScopePathResolver"/> — the producer that turns an ACL row's
|
||||
/// <c>ScopeId</c> into the trie path(s) a grant on it must be planted at (#520 stage 3).
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// The fixture is deliberately a <b>deeply nested</b> raw tree — two nested folders and two nested
|
||||
/// tag groups — because the shape that broke the previous design is exactly the one a shallow
|
||||
/// fixture cannot express. A five-level ladder resolves the shallowest possible raw tree correctly
|
||||
/// and silently truncates this one.
|
||||
/// </remarks>
|
||||
public sealed class AclScopePathResolverTests
|
||||
{
|
||||
// Plant/Line1 (nested folders) → ModbusDrv → dev1 → Fast/Inner (nested groups) → Speed
|
||||
private static AclScopePathResolver Fixture() => new(
|
||||
folders: new Dictionary<string, (string? ParentId, string Name)>
|
||||
{
|
||||
["RF-plant"] = (null, "Plant"),
|
||||
["RF-line1"] = ("RF-plant", "Line1"),
|
||||
},
|
||||
drivers: new Dictionary<string, (string? RawFolderId, string Name)>
|
||||
{
|
||||
["DI-modbus"] = ("RF-line1", "ModbusDrv"),
|
||||
["DI-rootlevel"] = (null, "RootDrv"),
|
||||
},
|
||||
devices: new Dictionary<string, (string DriverInstanceId, string Name)>
|
||||
{
|
||||
["DV-1"] = ("DI-modbus", "dev1"),
|
||||
},
|
||||
groups: new Dictionary<string, (string? ParentId, string DeviceId, string Name)>
|
||||
{
|
||||
["TG-fast"] = (null, "DV-1", "Fast"),
|
||||
["TG-inner"] = ("TG-fast", "DV-1", "Inner"),
|
||||
},
|
||||
tags: new Dictionary<string, (string DeviceId, string? TagGroupId, string Name)>
|
||||
{
|
||||
["TAG-speed"] = ("DV-1", "TG-inner", "Speed"),
|
||||
["TAG-bare"] = ("DV-1", null, "Bare"),
|
||||
},
|
||||
areas: new Dictionary<string, string> { ["UA-w"] = "West" },
|
||||
lines: new Dictionary<string, (string UnsAreaId, string Name)> { ["UL-1"] = ("UA-w", "L1") },
|
||||
equipment: new Dictionary<string, (string UnsLineId, string Name)>
|
||||
{
|
||||
["EQ-mixer"] = ("UL-1", "Mixer"),
|
||||
["EQ-filler"] = ("UL-1", "Filler"),
|
||||
},
|
||||
references:
|
||||
[
|
||||
("EQ-mixer", "TAG-speed", "MixerSpeed"),
|
||||
("EQ-filler", "TAG-speed", "FillerSpeed"),
|
||||
]);
|
||||
|
||||
private static IReadOnlyList<string> Single(NodeAclScopeKind kind, string scopeId) =>
|
||||
Fixture().ResolveOne(kind, scopeId).ShouldHaveSingleItem().Segments;
|
||||
|
||||
[Fact]
|
||||
public void A_nested_raw_folder_resolves_through_its_whole_ancestor_chain()
|
||||
{
|
||||
Single(NodeAclScopeKind.RawFolder, "RF-line1").ShouldBe(["raw", "Plant", "Line1"]);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void A_raw_device_resolves_through_folders_and_its_driver()
|
||||
{
|
||||
Single(NodeAclScopeKind.RawDevice, "DV-1").ShouldBe(["raw", "Plant", "Line1", "ModbusDrv", "dev1"]);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void A_nested_tag_group_resolves_through_its_own_ancestor_chain_too()
|
||||
{
|
||||
// Both nesting axes at once — the folder chain AND the group chain. This is the case a
|
||||
// fixed-depth scope model cannot represent at all: it needs seven segments below the realm.
|
||||
Single(NodeAclScopeKind.RawTagGroup, "TG-inner")
|
||||
.ShouldBe(["raw", "Plant", "Line1", "ModbusDrv", "dev1", "Fast", "Inner"]);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void Every_container_path_is_a_true_prefix_of_the_tag_beneath_it()
|
||||
{
|
||||
// The invariant the trie walk depends on: a grant on a container only cascades to the tags below
|
||||
// it if the container's path is a genuine prefix of theirs. If the container paths were composed
|
||||
// in a different order from the tag path — the obvious way to get this wrong, since the tag path
|
||||
// comes from RawPathResolver and the container paths are composed here — a container grant would
|
||||
// land on a sibling branch and silently protect nothing.
|
||||
var resolver = Fixture();
|
||||
var tag = resolver.ResolveOne(NodeAclScopeKind.Tag, "TAG-speed")
|
||||
.First(p => p.Segments[0] == NodeAclRealms.Raw).Segments;
|
||||
|
||||
foreach (var (kind, id) in new[]
|
||||
{
|
||||
(NodeAclScopeKind.RawFolder, "RF-plant"),
|
||||
(NodeAclScopeKind.RawFolder, "RF-line1"),
|
||||
(NodeAclScopeKind.RawDriver, "DI-modbus"),
|
||||
(NodeAclScopeKind.RawDevice, "DV-1"),
|
||||
(NodeAclScopeKind.RawTagGroup, "TG-fast"),
|
||||
(NodeAclScopeKind.RawTagGroup, "TG-inner"),
|
||||
})
|
||||
{
|
||||
var container = resolver.ResolveOne(kind, id).ShouldHaveSingleItem().Segments;
|
||||
container.Count.ShouldBeLessThan(tag.Count, $"{kind} {id}");
|
||||
tag.Take(container.Count).ShouldBe(container, $"{kind} {id} is not a prefix of the tag path");
|
||||
}
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void A_tag_resolves_to_its_raw_node_AND_every_UNS_projection_of_it()
|
||||
{
|
||||
// A raw tag referenced by two equipments is reachable at three NodeIds, and a write through any
|
||||
// of them lands on the same driver reference. A grant covering only the raw node would be
|
||||
// bypassable through either UNS NodeId — so all three must be planted.
|
||||
var paths = Fixture().ResolveOne(NodeAclScopeKind.Tag, "TAG-speed")
|
||||
.Select(p => p.Segments)
|
||||
.ToList();
|
||||
|
||||
paths.Count.ShouldBe(3);
|
||||
paths.ShouldContain(s => s.SequenceEqual(
|
||||
new[] { "raw", "Plant", "Line1", "ModbusDrv", "dev1", "Fast", "Inner", "Speed" }));
|
||||
paths.ShouldContain(s => s.SequenceEqual(new[] { "uns", "West", "L1", "Mixer", "MixerSpeed" }));
|
||||
paths.ShouldContain(s => s.SequenceEqual(new[] { "uns", "West", "L1", "Filler", "FillerSpeed" }));
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void A_tag_with_no_UNS_reference_resolves_to_its_raw_node_only()
|
||||
{
|
||||
// The positive control for the test above: it proves the three-path result came from the two
|
||||
// references rather than from the resolver always emitting extra paths.
|
||||
Single(NodeAclScopeKind.Tag, "TAG-bare")
|
||||
.ShouldBe(["raw", "Plant", "Line1", "ModbusDrv", "dev1", "Bare"]);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void A_driver_at_the_cluster_root_has_no_folder_segments()
|
||||
{
|
||||
Single(NodeAclScopeKind.RawDriver, "DI-rootlevel").ShouldBe(["raw", "RootDrv"]);
|
||||
}
|
||||
|
||||
[Theory]
|
||||
[InlineData(NodeAclScopeKind.UnsArea, "UA-w", new[] { "uns", "West" })]
|
||||
[InlineData(NodeAclScopeKind.UnsLine, "UL-1", new[] { "uns", "West", "L1" })]
|
||||
[InlineData(NodeAclScopeKind.Equipment, "EQ-mixer", new[] { "uns", "West", "L1", "Mixer" })]
|
||||
public void UNS_scopes_resolve_to_their_name_path(NodeAclScopeKind kind, string id, string[] expected)
|
||||
{
|
||||
Single(kind, id).ShouldBe(expected);
|
||||
}
|
||||
|
||||
[Theory]
|
||||
[InlineData("raw", "raw")]
|
||||
[InlineData("RAW", "raw")]
|
||||
[InlineData("uns", "uns")]
|
||||
[InlineData("https://zb.com/otopcua/raw", "raw")]
|
||||
[InlineData("https://zb.com/otopcua/uns", "uns")]
|
||||
public void A_namespace_scope_accepts_the_token_or_the_full_uri(string scopeId, string expected)
|
||||
{
|
||||
Single(NodeAclScopeKind.Namespace, scopeId).ShouldBe([expected]);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void A_namespace_scope_naming_no_realm_resolves_to_nothing()
|
||||
{
|
||||
Fixture().ResolveOne(NodeAclScopeKind.Namespace, "https://zb.com/otopcua/ns").ShouldBeEmpty();
|
||||
}
|
||||
|
||||
[Theory]
|
||||
[InlineData(NodeAclScopeKind.RawFolder, "RF-nope")]
|
||||
[InlineData(NodeAclScopeKind.RawDriver, "DI-nope")]
|
||||
[InlineData(NodeAclScopeKind.RawDevice, "DV-nope")]
|
||||
[InlineData(NodeAclScopeKind.RawTagGroup, "TG-nope")]
|
||||
[InlineData(NodeAclScopeKind.Tag, "TAG-nope")]
|
||||
[InlineData(NodeAclScopeKind.UnsArea, "UA-nope")]
|
||||
[InlineData(NodeAclScopeKind.UnsLine, "UL-nope")]
|
||||
[InlineData(NodeAclScopeKind.Equipment, "EQ-nope")]
|
||||
public void A_dangling_scope_id_resolves_to_nothing(NodeAclScopeKind kind, string scopeId)
|
||||
{
|
||||
// Resolving to nothing is what makes the builder DROP the grant with a diagnostic. The dangerous
|
||||
// alternative — inventing a path — would plant an operator's grant on some other node.
|
||||
Fixture().ResolveOne(kind, scopeId).ShouldBeEmpty();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void The_retired_FolderSegment_kind_resolves_to_nothing()
|
||||
{
|
||||
// It described a v2 hierarchy that v3 deleted. Deliberately unresolvable so a surviving row
|
||||
// produces a diagnostic naming it, rather than a grant that quietly does nothing.
|
||||
Fixture().ResolveOne(NodeAclScopeKind.FolderSegment, "RF-line1").ShouldBeEmpty();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void A_corrupt_parent_cycle_terminates_instead_of_hanging()
|
||||
{
|
||||
// Folder nesting is unbounded by design, so the walk cannot be bounded by a schema limit — only
|
||||
// by a cycle guard. Without one a corrupt artifact would hang the deploy-apply thread rather than
|
||||
// dropping one grant.
|
||||
var resolver = new AclScopePathResolver(
|
||||
folders: new Dictionary<string, (string? ParentId, string Name)>
|
||||
{
|
||||
["A"] = ("B", "A"),
|
||||
["B"] = ("A", "B"),
|
||||
},
|
||||
drivers: new Dictionary<string, (string? RawFolderId, string Name)>(),
|
||||
devices: new Dictionary<string, (string DriverInstanceId, string Name)>(),
|
||||
groups: new Dictionary<string, (string? ParentId, string DeviceId, string Name)>(),
|
||||
tags: new Dictionary<string, (string DeviceId, string? TagGroupId, string Name)>(),
|
||||
areas: new Dictionary<string, string>(),
|
||||
lines: new Dictionary<string, (string UnsAreaId, string Name)>(),
|
||||
equipment: new Dictionary<string, (string UnsLineId, string Name)>(),
|
||||
references: []);
|
||||
|
||||
resolver.ResolveOne(NodeAclScopeKind.RawFolder, "A").ShouldBeEmpty();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void Resolve_keys_on_the_kind_as_well_as_the_id()
|
||||
{
|
||||
// ScopeId is a bare string with no FK and no type discriminator; ids are prefixed only by
|
||||
// convention. Keying the lookup on the id alone would let one entity's id collide with another's
|
||||
// and hand a grant the wrong node's paths — a silent wrong-node authorization.
|
||||
var resolver = new AclScopePathResolver(
|
||||
folders: new Dictionary<string, (string? ParentId, string Name)> { ["dup"] = (null, "AsFolder") },
|
||||
drivers: new Dictionary<string, (string? RawFolderId, string Name)>(),
|
||||
devices: new Dictionary<string, (string DriverInstanceId, string Name)>(),
|
||||
groups: new Dictionary<string, (string? ParentId, string DeviceId, string Name)>(),
|
||||
tags: new Dictionary<string, (string DeviceId, string? TagGroupId, string Name)>(),
|
||||
areas: new Dictionary<string, string> { ["dup"] = "AsArea" },
|
||||
lines: new Dictionary<string, (string UnsAreaId, string Name)>(),
|
||||
equipment: new Dictionary<string, (string UnsLineId, string Name)>(),
|
||||
references: []);
|
||||
|
||||
var resolved = resolver.Resolve(
|
||||
[
|
||||
Acl("acl-1", NodeAclScopeKind.RawFolder, "dup"),
|
||||
Acl("acl-2", NodeAclScopeKind.UnsArea, "dup"),
|
||||
]);
|
||||
|
||||
resolved[new AclScopeRef(NodeAclScopeKind.RawFolder, "dup")]
|
||||
.ShouldHaveSingleItem().Segments.ShouldBe(["raw", "AsFolder"]);
|
||||
resolved[new AclScopeRef(NodeAclScopeKind.UnsArea, "dup")]
|
||||
.ShouldHaveSingleItem().Segments.ShouldBe(["uns", "AsArea"]);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void Resolve_omits_cluster_scoped_and_unresolvable_rows()
|
||||
{
|
||||
var resolved = Fixture().Resolve(
|
||||
[
|
||||
Acl("acl-cluster", NodeAclScopeKind.Cluster, null),
|
||||
Acl("acl-dangling", NodeAclScopeKind.Equipment, "EQ-nope"),
|
||||
Acl("acl-good", NodeAclScopeKind.Equipment, "EQ-mixer"),
|
||||
]);
|
||||
|
||||
resolved.Count.ShouldBe(1);
|
||||
resolved.ShouldContainKey(new AclScopeRef(NodeAclScopeKind.Equipment, "EQ-mixer"));
|
||||
}
|
||||
|
||||
private static NodeAcl Acl(string id, NodeAclScopeKind kind, string? scopeId) => new()
|
||||
{
|
||||
NodeAclId = id,
|
||||
ClusterId = "c1",
|
||||
Principal = "p",
|
||||
ScopeKind = kind,
|
||||
ScopeId = scopeId,
|
||||
PermissionFlags = NodePermissions.Read,
|
||||
};
|
||||
}
|
||||
+23
-15
@@ -14,6 +14,14 @@ public sealed class DataPlaneAuthorityStateTests
|
||||
{
|
||||
private static readonly DateTime Now = new(2026, 7, 31, 12, 0, 0, DateTimeKind.Utc);
|
||||
|
||||
/// <summary>
|
||||
/// These tests are about key lookup and the generation counter, not about scope resolution, so
|
||||
/// they install no scope paths. Resolution is covered by <c>AclScopePathResolverTests</c> and the
|
||||
/// artifact-to-walk path by <c>DeploymentArtifactScopePathTests</c>.
|
||||
/// </summary>
|
||||
private static readonly IReadOnlyDictionary<AclScopeRef, IReadOnlyList<NodeAclPath>> NoScopes =
|
||||
new Dictionary<AclScopeRef, IReadOnlyList<NodeAclPath>>();
|
||||
|
||||
[Fact]
|
||||
public void Before_any_artifact_the_node_authenticates_nothing()
|
||||
{
|
||||
@@ -30,8 +38,8 @@ public sealed class DataPlaneAuthorityStateTests
|
||||
{
|
||||
var sut = new DataPlaneAuthorityState();
|
||||
|
||||
sut.Apply(null, "rev-1", [], []).GenerationId.ShouldBe(1);
|
||||
sut.Apply(null, "rev-2", [], []).GenerationId.ShouldBe(2);
|
||||
sut.Apply(null, "rev-1", [], [], NoScopes).GenerationId.ShouldBe(1);
|
||||
sut.Apply(null, "rev-2", [], [], NoScopes).GenerationId.ShouldBe(2);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
@@ -41,8 +49,8 @@ public sealed class DataPlaneAuthorityStateTests
|
||||
// generation there would invalidate every cached authorization decision for no reason.
|
||||
var sut = new DataPlaneAuthorityState();
|
||||
|
||||
sut.Apply(null, "rev-1", [], []).GenerationId.ShouldBe(1);
|
||||
sut.Apply(null, "rev-1", [], []).GenerationId.ShouldBe(1);
|
||||
sut.Apply(null, "rev-1", [], [], NoScopes).GenerationId.ShouldBe(1);
|
||||
sut.Apply(null, "rev-1", [], [], NoScopes).GenerationId.ShouldBe(1);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
@@ -56,7 +64,7 @@ public sealed class DataPlaneAuthorityStateTests
|
||||
var sut = new DataPlaneAuthorityState();
|
||||
|
||||
var generations = new[] { "ffff", "cccc", "aaaa", "0001" }
|
||||
.Select(rev => sut.Apply(null, rev, [], []).GenerationId)
|
||||
.Select(rev => sut.Apply(null, rev, [], [], NoScopes).GenerationId)
|
||||
.ToArray();
|
||||
|
||||
generations.ShouldBe([1, 2, 3, 4]);
|
||||
@@ -66,7 +74,7 @@ public sealed class DataPlaneAuthorityStateTests
|
||||
public void A_usable_key_is_found_by_id()
|
||||
{
|
||||
var sut = new DataPlaneAuthorityState();
|
||||
sut.Apply("cluster-a", "rev-1", [Key("abc", "p")], []);
|
||||
sut.Apply("cluster-a", "rev-1", [Key("abc", "p")], [], NoScopes);
|
||||
|
||||
sut.Current.FindUsableKey("abc", Now)!.Principal.ShouldBe("p");
|
||||
}
|
||||
@@ -77,7 +85,7 @@ public sealed class DataPlaneAuthorityStateTests
|
||||
// Key ids are minted lowercase hex, but an operator copying one out of the AdminUI can upper-case
|
||||
// it. A case-sensitive miss would read to them as "the key was revoked".
|
||||
var sut = new DataPlaneAuthorityState();
|
||||
sut.Apply(null, "rev-1", [Key("abc", "p")], []);
|
||||
sut.Apply(null, "rev-1", [Key("abc", "p")], [], NoScopes);
|
||||
|
||||
sut.Current.FindUsableKey("ABC", Now).ShouldNotBeNull();
|
||||
}
|
||||
@@ -88,7 +96,7 @@ public sealed class DataPlaneAuthorityStateTests
|
||||
var revoked = Key("abc", "p");
|
||||
revoked.Enabled = false;
|
||||
var sut = new DataPlaneAuthorityState();
|
||||
sut.Apply(null, "rev-1", [revoked], []);
|
||||
sut.Apply(null, "rev-1", [revoked], [], NoScopes);
|
||||
|
||||
sut.Current.FindUsableKey("abc", Now).ShouldBeNull();
|
||||
}
|
||||
@@ -101,7 +109,7 @@ public sealed class DataPlaneAuthorityStateTests
|
||||
var expiring = Key("abc", "p");
|
||||
expiring.ExpiresUtc = Now;
|
||||
var sut = new DataPlaneAuthorityState();
|
||||
sut.Apply(null, "rev-1", [expiring], []);
|
||||
sut.Apply(null, "rev-1", [expiring], [], NoScopes);
|
||||
|
||||
sut.Current.FindUsableKey("abc", Now).ShouldBeNull("expiry is inclusive — at the instant it expires it is gone");
|
||||
sut.Current.FindUsableKey("abc", Now.AddSeconds(-1)).ShouldNotBeNull();
|
||||
@@ -115,7 +123,7 @@ public sealed class DataPlaneAuthorityStateTests
|
||||
[
|
||||
Acl("acl-1", "alice", NodePermissions.Read),
|
||||
Acl("acl-2", "bob", NodePermissions.WriteOperate),
|
||||
]);
|
||||
], NoScopes);
|
||||
|
||||
sut.Current.GrantsFor("alice").ShouldHaveSingleItem().NodeAclId.ShouldBe("acl-1");
|
||||
sut.Current.GrantsFor("nobody").ShouldBeEmpty();
|
||||
@@ -129,7 +137,7 @@ public sealed class DataPlaneAuthorityStateTests
|
||||
[
|
||||
Acl("acl-1", "alice", NodePermissions.Read),
|
||||
Acl("acl-2", "alice", NodePermissions.WriteOperate),
|
||||
]);
|
||||
], NoScopes);
|
||||
|
||||
sut.Current.GrantsFor("alice").Count.ShouldBe(2);
|
||||
}
|
||||
@@ -140,8 +148,8 @@ public sealed class DataPlaneAuthorityStateTests
|
||||
// Merging would make revocation impossible: a key dropped from the artifact would live on in the
|
||||
// node's memory forever.
|
||||
var sut = new DataPlaneAuthorityState();
|
||||
sut.Apply(null, "rev-1", [Key("old", "p")], []);
|
||||
sut.Apply(null, "rev-2", [Key("new", "p")], []);
|
||||
sut.Apply(null, "rev-1", [Key("old", "p")], [], NoScopes);
|
||||
sut.Apply(null, "rev-2", [Key("new", "p")], [], NoScopes);
|
||||
|
||||
sut.Current.FindUsableKey("old", Now).ShouldBeNull();
|
||||
sut.Current.FindUsableKey("new", Now).ShouldNotBeNull();
|
||||
@@ -154,7 +162,7 @@ public sealed class DataPlaneAuthorityStateTests
|
||||
// artifact — where refusing to build the snapshot would leave the node authenticating nothing.
|
||||
var sut = new DataPlaneAuthorityState();
|
||||
|
||||
Should.NotThrow(() => sut.Apply(null, "rev-1", [Key("dup", "a"), Key("dup", "b")], []));
|
||||
Should.NotThrow(() => sut.Apply(null, "rev-1", [Key("dup", "a"), Key("dup", "b")], [], NoScopes));
|
||||
sut.Current.FindUsableKey("dup", Now).ShouldNotBeNull();
|
||||
}
|
||||
|
||||
@@ -164,7 +172,7 @@ public sealed class DataPlaneAuthorityStateTests
|
||||
// The node manager's only source of cluster identity; NodeScope.ClusterId is required and the
|
||||
// evaluator fails closed when it disagrees with the session's.
|
||||
var sut = new DataPlaneAuthorityState();
|
||||
sut.Apply("cluster-a", "rev-1", [], []);
|
||||
sut.Apply("cluster-a", "rev-1", [], [], NoScopes);
|
||||
|
||||
sut.Current.ClusterId.ShouldBe("cluster-a");
|
||||
}
|
||||
|
||||
+258
-64
@@ -7,17 +7,19 @@ using ZB.MOM.WW.OtOpcUa.Core.Authorization;
|
||||
namespace ZB.MOM.WW.OtOpcUa.Core.Tests.Authorization;
|
||||
|
||||
/// <summary>
|
||||
/// Core-011 regression coverage for <see cref="PermissionTrieBuilder.Build"/>'s
|
||||
/// <c>Descend</c> helper:
|
||||
/// Core-011 regression coverage for <see cref="PermissionTrieBuilder.Build"/>'s row placement:
|
||||
/// <list type="bullet">
|
||||
/// <item>With a <c>scopePaths</c> lookup the row must land at the correct multi-level
|
||||
/// trie node — a deep <see cref="NodeAclScopeKind.UnsLine"/> grant must be visible
|
||||
/// ONLY when the requested scope walks the same namespace/area/line chain.</item>
|
||||
/// <item>Without a <c>scopePaths</c> entry the row falls back to a direct child of
|
||||
/// the namespace root keyed on the row's <c>ScopeId</c>. The builder must surface
|
||||
/// this fallback (warning callback) so callers know a grant was placed where the
|
||||
/// walker can't reach it for production hierarchies — silently dropping the grant
|
||||
/// is the Core-011 production hazard.</item>
|
||||
/// <item>A row whose scope resolves must land at the correct multi-level trie node — a deep
|
||||
/// <see cref="NodeAclScopeKind.UnsLine"/> grant is visible ONLY when the requested scope
|
||||
/// walks the same realm/area/line chain.</item>
|
||||
/// <item>A row whose scope does NOT resolve must be <b>dropped with a diagnostic</b>. Before
|
||||
/// #520 stage 3 it was planted as a direct child of the trie root keyed on <c>ScopeId</c>,
|
||||
/// a position level 1 of the walk (the realm) can never reach — so the grant looked placed
|
||||
/// and could never match. Silently misplacing the grant is the Core-011 production
|
||||
/// hazard.</item>
|
||||
/// <item>A scope resolving to several paths (a raw tag projected into N equipments) must plant
|
||||
/// the grant at <b>all</b> of them, or the grant is bypassable through the NodeId it
|
||||
/// missed.</item>
|
||||
/// </list>
|
||||
/// </summary>
|
||||
[Trait("Category", "Unit")]
|
||||
@@ -35,78 +37,150 @@ public sealed class PermissionTrieBuilderTests
|
||||
PermissionFlags = flags,
|
||||
};
|
||||
|
||||
private static NodeScope EquipmentTag(string cluster, string ns, string area, string line, string equip, string tag) =>
|
||||
new()
|
||||
/// <summary>One scope resolving to one path.</summary>
|
||||
private static IReadOnlyDictionary<AclScopeRef, IReadOnlyList<NodeAclPath>> ScopePaths(
|
||||
params (NodeAclScopeKind Kind, string ScopeId, string[] Segments)[] entries) =>
|
||||
entries.ToDictionary(
|
||||
e => new AclScopeRef(e.Kind, e.ScopeId),
|
||||
e => (IReadOnlyList<NodeAclPath>)new[] { new NodeAclPath(e.Segments) });
|
||||
|
||||
/// <summary>A UNS-realm trie path: <c>uns / …segments…</c>.</summary>
|
||||
private static string[] UnsPath(params string[] segments) => [NodeAclRealms.Uns, .. segments];
|
||||
|
||||
/// <summary>A raw-realm trie path: <c>raw / …segments…</c>.</summary>
|
||||
private static string[] RawPath(params string[] segments) => [NodeAclRealms.Raw, .. segments];
|
||||
|
||||
[Fact]
|
||||
public void Build_Path_Not_Starting_At_A_Realm_Is_Rejected_Not_Planted()
|
||||
{
|
||||
// Level 1 of the walk is always a realm token, so each of these addresses a node CollectMatches
|
||||
// can never reach. Without this guard the grant would be planted, look present in the trie, and
|
||||
// silently never match — the same failure mode as the deleted root-child fallback, just relocated
|
||||
// into the scope-path producer where nothing else cross-checks it.
|
||||
string[][] malformed =
|
||||
[
|
||||
[], // empty path
|
||||
["area-1", "line-1"], // producer forgot the realm segment
|
||||
["Raw", "area-1"], // realm token with the wrong case
|
||||
["https://zb.com/otopcua/raw", "area-1"], // URI where the short token belongs
|
||||
];
|
||||
|
||||
foreach (var segments in malformed)
|
||||
{
|
||||
ClusterId = cluster,
|
||||
NamespaceId = ns,
|
||||
UnsAreaId = area,
|
||||
UnsLineId = line,
|
||||
EquipmentId = equip,
|
||||
TagId = tag,
|
||||
Kind = NodeHierarchyKind.Equipment,
|
||||
var diagnostics = new List<PermissionTrieBuildDiagnostic>();
|
||||
var rows = new[] { Row("cn=a", NodeAclScopeKind.UnsLine, "line-1", NodePermissions.Read) };
|
||||
var paths = new Dictionary<AclScopeRef, IReadOnlyList<NodeAclPath>>
|
||||
{
|
||||
[new AclScopeRef(NodeAclScopeKind.UnsLine, "line-1")] = [new NodeAclPath(segments)],
|
||||
};
|
||||
|
||||
var label = segments.Length == 0 ? "(empty)" : string.Join('/', segments);
|
||||
var trie = PermissionTrieBuilder.Build("c1", 1, rows, paths, diagnostics.Add);
|
||||
|
||||
diagnostics.ShouldHaveSingleItem(label).Reason
|
||||
.ShouldBe(PermissionTrieBuildDiagnosticReason.InvalidScopePath, label);
|
||||
trie.Root.Children.ShouldBeEmpty(label);
|
||||
}
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void Build_Plants_The_Valid_Paths_Of_A_Scope_Even_When_A_Sibling_Path_Is_Malformed()
|
||||
{
|
||||
// The positive control for the theory above: a guard that rejected every path would satisfy it.
|
||||
// A multi-path scope must keep the reachable placements and drop only the broken one.
|
||||
var diagnostics = new List<PermissionTrieBuildDiagnostic>();
|
||||
var rows = new[] { Row("cn=a", NodeAclScopeKind.Tag, "tag-1", NodePermissions.Read) };
|
||||
var paths = new Dictionary<AclScopeRef, IReadOnlyList<NodeAclPath>>
|
||||
{
|
||||
[new AclScopeRef(NodeAclScopeKind.Tag, "tag-1")] =
|
||||
[
|
||||
new NodeAclPath(RawPath("Drv", "dev1", "Speed")),
|
||||
new NodeAclPath(["area-1", "line-1"]),
|
||||
],
|
||||
};
|
||||
|
||||
var trie = PermissionTrieBuilder.Build("c1", 1, rows, paths, diagnostics.Add);
|
||||
|
||||
diagnostics.ShouldHaveSingleItem().Reason
|
||||
.ShouldBe(PermissionTrieBuildDiagnosticReason.InvalidScopePath);
|
||||
trie.CollectMatches(
|
||||
new NodeScope
|
||||
{
|
||||
ClusterId = "c1",
|
||||
Kind = NodeHierarchyKind.Raw,
|
||||
Segments = ["Drv", "dev1", "Speed"],
|
||||
},
|
||||
["cn=a"]).ShouldHaveSingleItem();
|
||||
}
|
||||
|
||||
/// <summary>A node in the UNS realm addressed by its path below the realm segment.</summary>
|
||||
private static NodeScope UnsScope(string cluster, params string[] segments) =>
|
||||
new() { ClusterId = cluster, Kind = NodeHierarchyKind.Uns, Segments = segments };
|
||||
|
||||
/// <summary>A node in the raw realm addressed by its path below the realm segment.</summary>
|
||||
private static NodeScope RawScope(string cluster, params string[] segments) =>
|
||||
new() { ClusterId = cluster, Kind = NodeHierarchyKind.Raw, Segments = segments };
|
||||
|
||||
/// <summary>Verifies that Build with ScopePaths places UnsLine row at correct multi-level node.</summary>
|
||||
[Fact]
|
||||
public void Build_With_ScopePaths_Places_UnsLine_Row_At_Correct_Multi_Level_Node()
|
||||
{
|
||||
// Scope path mirrors the production hierarchy: namespace → area → line.
|
||||
var paths = new Dictionary<string, NodeAclPath>(StringComparer.OrdinalIgnoreCase)
|
||||
{
|
||||
["line-42"] = new(new[] { "ns", "area-1", "line-42" }),
|
||||
};
|
||||
// Scope path mirrors the production hierarchy: realm → area → line.
|
||||
var paths = ScopePaths(
|
||||
(NodeAclScopeKind.UnsLine, "line-42", UnsPath("area-1", "line-42")));
|
||||
var rows = new[] { Row("cn=ops", NodeAclScopeKind.UnsLine, "line-42", NodePermissions.Read) };
|
||||
|
||||
var trie = PermissionTrieBuilder.Build("c1", 1, rows, paths);
|
||||
|
||||
// Walk through the same chain — the grant must be reachable.
|
||||
var matchOnLine = trie.CollectMatches(
|
||||
EquipmentTag("c1", "ns", "area-1", "line-42", "eq-A", "tag-A"),
|
||||
UnsScope("c1", "area-1", "line-42", "eq-A", "tag-A"),
|
||||
["cn=ops"]);
|
||||
matchOnLine.Count.ShouldBe(1, "row must land at the correct multi-level trie node");
|
||||
|
||||
// A different line under the same area must not pick up the grant.
|
||||
var matchOnOtherLine = trie.CollectMatches(
|
||||
EquipmentTag("c1", "ns", "area-1", "line-99", "eq-A", "tag-A"),
|
||||
UnsScope("c1", "area-1", "line-99", "eq-A", "tag-A"),
|
||||
["cn=ops"]);
|
||||
matchOnOtherLine.ShouldBeEmpty(
|
||||
"grant anchored at line-42 must not leak to sibling line-99 under the same area");
|
||||
}
|
||||
|
||||
/// <summary>Verifies that Build without ScopePaths falls back to root child for deterministic tests.</summary>
|
||||
/// <summary>
|
||||
/// Replaces <c>Build_Without_ScopePaths_Falls_Back_To_Root_Child_For_Tests</c>: the null-scopePaths
|
||||
/// "deterministic test mode" is deleted. An unresolvable sub-cluster row is now dropped entirely —
|
||||
/// it must NOT appear as a root child keyed on its <c>ScopeId</c>, because level 1 of the walk is
|
||||
/// the realm and nothing can ever reach such a node.
|
||||
/// </summary>
|
||||
[Fact]
|
||||
public void Build_Without_ScopePaths_Falls_Back_To_Root_Child_For_Tests()
|
||||
public void Build_Unresolvable_Row_Is_Dropped_Not_Planted_At_Root_Child()
|
||||
{
|
||||
// Fallback path — deterministic tests pass without a scope-path lookup. The row
|
||||
// is placed as a direct child of the trie root keyed by ScopeId.
|
||||
var rows = new[] { Row("cn=ops", NodeAclScopeKind.UnsLine, "line-42", NodePermissions.Read) };
|
||||
|
||||
var trie = PermissionTrieBuilder.Build("c1", 1, rows);
|
||||
var trie = PermissionTrieBuilder.Build(
|
||||
"c1", 1, rows, new Dictionary<AclScopeRef, IReadOnlyList<NodeAclPath>>());
|
||||
|
||||
// Root has one child — "line-42".
|
||||
trie.Root.Children.ShouldContainKey("line-42");
|
||||
var node = trie.Root.Children["line-42"];
|
||||
node.Grants.Count.ShouldBe(1);
|
||||
trie.Root.Children.ShouldNotContainKey("line-42",
|
||||
"the retired fallback planted the row here, where the realm-first walk can never reach it");
|
||||
trie.Root.Children.ShouldBeEmpty();
|
||||
trie.Root.Grants.ShouldBeEmpty("an unresolvable row must not become a cluster-wide grant either");
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Core-011 regression: when a sub-cluster row's ScopeId is not in the supplied
|
||||
/// <c>scopePaths</c>, the fallback diagnostic callback must fire so the caller can
|
||||
/// surface a warning. Silently dropping the grant under the wrong trie level is the
|
||||
/// production hazard the finding flagged.
|
||||
/// Core-011 regression: when a sub-cluster row's scope is not in the supplied <c>scopePaths</c>,
|
||||
/// the diagnostic callback must fire so the caller can surface a warning. Silently dropping the
|
||||
/// grant is the production hazard the finding flagged.
|
||||
/// </summary>
|
||||
[Fact]
|
||||
public void Build_Missing_ScopePath_Entry_Invokes_Diagnostic_Callback()
|
||||
{
|
||||
var paths = new Dictionary<string, NodeAclPath>(StringComparer.OrdinalIgnoreCase)
|
||||
{
|
||||
["line-known"] = new(new[] { "ns", "area-1", "line-known" }),
|
||||
};
|
||||
var paths = ScopePaths(
|
||||
(NodeAclScopeKind.UnsLine, "line-known", UnsPath("area-1", "line-known")));
|
||||
// Row references a line that is NOT in the path lookup.
|
||||
var orphan = Row("cn=ops", NodeAclScopeKind.UnsLine, "line-orphan", NodePermissions.Read);
|
||||
var rows = new[]
|
||||
{
|
||||
Row("cn=ops", NodeAclScopeKind.UnsLine, "line-orphan", NodePermissions.Read),
|
||||
orphan,
|
||||
Row("cn=ops", NodeAclScopeKind.UnsLine, "line-known", NodePermissions.Read),
|
||||
};
|
||||
var diagnostics = new List<PermissionTrieBuildDiagnostic>();
|
||||
@@ -114,45 +188,165 @@ public sealed class PermissionTrieBuilderTests
|
||||
var trie = PermissionTrieBuilder.Build("c1", 1, rows, paths, diagnostics.Add);
|
||||
|
||||
diagnostics.Count.ShouldBe(1, "exactly one row had no matching scope-path entry");
|
||||
diagnostics[0].NodeAclId.ShouldBe(orphan.NodeAclId);
|
||||
diagnostics[0].ScopeId.ShouldBe("line-orphan");
|
||||
diagnostics[0].ScopeKind.ShouldBe(NodeAclScopeKind.UnsLine);
|
||||
diagnostics[0].Reason.ShouldBe(PermissionTrieBuildDiagnosticReason.MissingScopePath);
|
||||
diagnostics[0].Reason.ShouldBe(PermissionTrieBuildDiagnosticReason.UnresolvedScope);
|
||||
|
||||
trie.CollectMatches(UnsScope("c1", "area-1", "line-known", "eq", "tag"), ["cn=ops"])
|
||||
.Count.ShouldBe(1, "the resolvable row is still placed");
|
||||
}
|
||||
|
||||
/// <summary>Verifies that no diagnostic is emitted when all sub-cluster rows have ScopePaths.</summary>
|
||||
/// <summary>
|
||||
/// The scope-path lookup is keyed on <c>(Kind, ScopeId)</c>, not the bare id: an entry filed under
|
||||
/// one kind must not resolve a row of another kind that happens to share the id. <c>ScopeId</c> is
|
||||
/// an unconstrained string, so id collisions across entity types are possible and resolving one
|
||||
/// through the other is a silent wrong-node authorization.
|
||||
/// </summary>
|
||||
[Fact]
|
||||
public void Build_No_Diagnostic_When_All_Sub_Cluster_Rows_Have_ScopePaths()
|
||||
public void Build_ScopePath_Lookup_Is_Keyed_On_Kind_As_Well_As_Id()
|
||||
{
|
||||
var paths = new Dictionary<string, NodeAclPath>(StringComparer.OrdinalIgnoreCase)
|
||||
{
|
||||
["line-A"] = new(new[] { "ns", "area-1", "line-A" }),
|
||||
["line-B"] = new(new[] { "ns", "area-1", "line-B" }),
|
||||
};
|
||||
var paths = ScopePaths(
|
||||
(NodeAclScopeKind.UnsLine, "shared-id", UnsPath("area-1", "line-1")));
|
||||
var rows = new[] { Row("cn=ops", NodeAclScopeKind.Equipment, "shared-id", NodePermissions.Read) };
|
||||
var diagnostics = new List<PermissionTrieBuildDiagnostic>();
|
||||
|
||||
var trie = PermissionTrieBuilder.Build("c1", 1, rows, paths, diagnostics.Add);
|
||||
|
||||
diagnostics.Count.ShouldBe(1);
|
||||
diagnostics[0].Reason.ShouldBe(PermissionTrieBuildDiagnosticReason.UnresolvedScope);
|
||||
trie.CollectMatches(UnsScope("c1", "area-1", "line-1", "eq", "tag"), ["cn=ops"])
|
||||
.ShouldBeEmpty("an Equipment row must not borrow a UnsLine entry's path");
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Verifies that a diagnostic fires for the unresolvable row and for that row only. The negative
|
||||
/// half on its own ("no diagnostics were emitted") passes for a <c>Build</c> that never emits any,
|
||||
/// so the positive control lives in the same build rather than in a separate test.
|
||||
/// </summary>
|
||||
[Fact]
|
||||
public void Build_Diagnostic_Fires_For_The_Unresolvable_Row_Only()
|
||||
{
|
||||
var paths = ScopePaths(
|
||||
(NodeAclScopeKind.UnsLine, "line-A", UnsPath("area-1", "line-A")),
|
||||
(NodeAclScopeKind.UnsLine, "line-B", UnsPath("area-1", "line-B")));
|
||||
var orphan = Row("cn=ops", NodeAclScopeKind.UnsLine, "line-orphan", NodePermissions.Read);
|
||||
var rows = new[]
|
||||
{
|
||||
Row("cn=ops", NodeAclScopeKind.Cluster, null, NodePermissions.Read), // cluster-level — no descent
|
||||
Row("cn=ops", NodeAclScopeKind.Cluster, null, NodePermissions.Read), // cluster-level — never descends
|
||||
Row("cn=ops", NodeAclScopeKind.UnsLine, "line-A", NodePermissions.Read),
|
||||
Row("cn=ops", NodeAclScopeKind.UnsLine, "line-B", NodePermissions.Read),
|
||||
orphan, // positive control
|
||||
};
|
||||
var diagnostics = new List<PermissionTrieBuildDiagnostic>();
|
||||
|
||||
PermissionTrieBuilder.Build("c1", 1, rows, paths, diagnostics.Add);
|
||||
var trie = PermissionTrieBuilder.Build("c1", 1, rows, paths, diagnostics.Add);
|
||||
|
||||
diagnostics.ShouldBeEmpty("no rows are missing a scope-path entry");
|
||||
diagnostics.Count.ShouldBe(1, "only the orphan row is unresolvable");
|
||||
diagnostics[0].NodeAclId.ShouldBe(orphan.NodeAclId,
|
||||
"the cluster row and the two resolvable line rows must not emit a diagnostic");
|
||||
|
||||
// …and the rows that did resolve are genuinely placed, so "one diagnostic" is not being reached
|
||||
// by dropping everything.
|
||||
trie.CollectMatches(UnsScope("c1", "area-1", "line-A", "eq", "tag"), ["cn=ops"])
|
||||
.Count.ShouldBe(2, "the cluster grant plus the line-A grant");
|
||||
trie.CollectMatches(UnsScope("c1", "area-1", "line-B", "eq", "tag"), ["cn=ops"])
|
||||
.Count.ShouldBe(2, "the cluster grant plus the line-B grant");
|
||||
}
|
||||
|
||||
/// <summary>Verifies that diagnostic callback is optional when ScopePaths is null.</summary>
|
||||
[Fact]
|
||||
public void Build_Diagnostic_Callback_Optional_When_ScopePaths_Null()
|
||||
/// <summary>
|
||||
/// Replaces <c>Build_Diagnostic_Callback_Optional_When_ScopePaths_Null</c> — <c>scopePaths</c> is
|
||||
/// required now, so the mode that test described no longer exists. What still needs pinning is the
|
||||
/// other authoring mistake: a sub-cluster row carrying no <c>ScopeId</c> names nothing, and used to
|
||||
/// vanish with no signal at all.
|
||||
/// </summary>
|
||||
[Theory]
|
||||
[InlineData(null)]
|
||||
[InlineData("")]
|
||||
public void Build_Sub_Cluster_Row_Without_ScopeId_Emits_MissingScopeId(string? scopeId)
|
||||
{
|
||||
// No diagnostics callback should fire when scopePaths itself is null — that's the
|
||||
// "deterministic-test fallback" mode, not a production drop.
|
||||
var rows = new[] { Row("cn=ops", NodeAclScopeKind.UnsLine, "line-42", NodePermissions.Read) };
|
||||
var row = Row("cn=ops", NodeAclScopeKind.UnsLine, scopeId, NodePermissions.Read);
|
||||
var diagnostics = new List<PermissionTrieBuildDiagnostic>();
|
||||
|
||||
PermissionTrieBuilder.Build("c1", 1, rows, scopePaths: null, diagnostic: diagnostics.Add);
|
||||
var trie = PermissionTrieBuilder.Build(
|
||||
"c1", 1, [row], new Dictionary<AclScopeRef, IReadOnlyList<NodeAclPath>>(), diagnostics.Add);
|
||||
|
||||
diagnostics.ShouldBeEmpty(
|
||||
"scopePaths=null is the explicit test-fallback mode and must not emit per-row warnings");
|
||||
diagnostics.Count.ShouldBe(1);
|
||||
diagnostics[0].NodeAclId.ShouldBe(row.NodeAclId);
|
||||
diagnostics[0].ScopeId.ShouldBeNull("the row had no scope id to report");
|
||||
diagnostics[0].Reason.ShouldBe(PermissionTrieBuildDiagnosticReason.MissingScopeId);
|
||||
trie.Root.Grants.ShouldBeEmpty("a scope-less sub-cluster row must not fall through to the cluster root");
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// A <see cref="NodeAclScopeKind.Cluster"/> row never consults <c>scopePaths</c> and never emits a
|
||||
/// diagnostic, even though it carries a null <c>ScopeId</c> — that is the one kind for which a null
|
||||
/// id is correct.
|
||||
/// </summary>
|
||||
[Fact]
|
||||
public void Build_Cluster_Row_With_Null_ScopeId_Is_Placed_Without_Diagnostic()
|
||||
{
|
||||
var rows = new[] { Row("cn=ops", NodeAclScopeKind.Cluster, null, NodePermissions.Read) };
|
||||
var diagnostics = new List<PermissionTrieBuildDiagnostic>();
|
||||
|
||||
var trie = PermissionTrieBuilder.Build(
|
||||
"c1", 1, rows, new Dictionary<AclScopeRef, IReadOnlyList<NodeAclPath>>(), diagnostics.Add);
|
||||
|
||||
diagnostics.ShouldBeEmpty();
|
||||
trie.Root.Grants.Count.ShouldBe(1);
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// A scope that resolves to several paths — a raw tag plus its UNS projections — plants the grant
|
||||
/// at every one of them. A write routes to the same driver reference through either NodeId, so a
|
||||
/// grant covering only one path would be bypassable through the other.
|
||||
/// </summary>
|
||||
[Fact]
|
||||
public void Build_Multi_Path_Scope_Plants_The_Grant_At_Every_Path()
|
||||
{
|
||||
var paths = new Dictionary<AclScopeRef, IReadOnlyList<NodeAclPath>>
|
||||
{
|
||||
[new AclScopeRef(NodeAclScopeKind.Tag, "tag-1")] = new[]
|
||||
{
|
||||
new NodeAclPath(RawPath("Plant", "Modbus", "dev1", "Speed")),
|
||||
new NodeAclPath(UnsPath("area-1", "line-1", "eq-A", "Speed")),
|
||||
new NodeAclPath(UnsPath("area-1", "line-1", "eq-B", "MotorSpeed")),
|
||||
},
|
||||
};
|
||||
var rows = new[] { Row("cn=ops", NodeAclScopeKind.Tag, "tag-1", NodePermissions.WriteOperate) };
|
||||
|
||||
var trie = PermissionTrieBuilder.Build("c1", 1, rows, paths);
|
||||
|
||||
trie.CollectMatches(RawScope("c1", "Plant", "Modbus", "dev1", "Speed"), ["cn=ops"])
|
||||
.Count.ShouldBe(1, "the raw NodeId");
|
||||
trie.CollectMatches(UnsScope("c1", "area-1", "line-1", "eq-A", "Speed"), ["cn=ops"])
|
||||
.Count.ShouldBe(1, "the first UNS projection");
|
||||
trie.CollectMatches(UnsScope("c1", "area-1", "line-1", "eq-B", "MotorSpeed"), ["cn=ops"])
|
||||
.Count.ShouldBe(1, "the second UNS projection, under its own effective name");
|
||||
trie.CollectMatches(UnsScope("c1", "area-1", "line-1", "eq-B", "Speed"), ["cn=ops"])
|
||||
.ShouldBeEmpty("eq-B projects the tag as MotorSpeed; the eq-A name must not match there");
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// An empty path list for a resolved key is treated the same as an absent key — dropped with an
|
||||
/// <see cref="PermissionTrieBuildDiagnosticReason.UnresolvedScope"/> diagnostic rather than
|
||||
/// silently planting the grant at the cluster root, which is where a zero-segment walk would leave
|
||||
/// it.
|
||||
/// </summary>
|
||||
[Fact]
|
||||
public void Build_Empty_Path_List_Is_Treated_As_Unresolved()
|
||||
{
|
||||
var paths = new Dictionary<AclScopeRef, IReadOnlyList<NodeAclPath>>
|
||||
{
|
||||
[new AclScopeRef(NodeAclScopeKind.Equipment, "eq-A")] = Array.Empty<NodeAclPath>(),
|
||||
};
|
||||
var rows = new[] { Row("cn=ops", NodeAclScopeKind.Equipment, "eq-A", NodePermissions.Read) };
|
||||
var diagnostics = new List<PermissionTrieBuildDiagnostic>();
|
||||
|
||||
var trie = PermissionTrieBuilder.Build("c1", 1, rows, paths, diagnostics.Add);
|
||||
|
||||
diagnostics.Count.ShouldBe(1);
|
||||
diagnostics[0].Reason.ShouldBe(PermissionTrieBuildDiagnosticReason.UnresolvedScope);
|
||||
trie.Root.Grants.ShouldBeEmpty("an empty path list must not become a cluster-wide grant");
|
||||
}
|
||||
}
|
||||
|
||||
@@ -6,9 +6,18 @@ using ZB.MOM.WW.OtOpcUa.Core.Authorization;
|
||||
|
||||
namespace ZB.MOM.WW.OtOpcUa.Core.Tests.Authorization;
|
||||
|
||||
/// <summary>
|
||||
/// Coverage for <see cref="PermissionTrie.CollectMatches"/> — the walk itself. Post-#520-stage-3 the
|
||||
/// walk is <c>cluster → realm → …variable-length node path…</c>, so every non-cluster test here
|
||||
/// supplies a real <c>scopePaths</c> entry whose path starts with a realm segment and drives a
|
||||
/// <see cref="NodeScope.Segments"/> chain through it.
|
||||
/// </summary>
|
||||
[Trait("Category", "Unit")]
|
||||
public sealed class PermissionTrieTests
|
||||
{
|
||||
private static readonly IReadOnlyDictionary<AclScopeRef, IReadOnlyList<NodeAclPath>> NoScopePaths =
|
||||
new Dictionary<AclScopeRef, IReadOnlyList<NodeAclPath>>();
|
||||
|
||||
private static NodeAcl Row(string group, NodeAclScopeKind scope, string? scopeId, NodePermissions flags, string clusterId = "c1") =>
|
||||
new()
|
||||
{
|
||||
@@ -21,27 +30,36 @@ public sealed class PermissionTrieTests
|
||||
PermissionFlags = flags,
|
||||
};
|
||||
|
||||
private static NodeScope EquipmentTag(string cluster, string ns, string area, string line, string equip, string tag) =>
|
||||
new()
|
||||
{
|
||||
ClusterId = cluster,
|
||||
NamespaceId = ns,
|
||||
UnsAreaId = area,
|
||||
UnsLineId = line,
|
||||
EquipmentId = equip,
|
||||
TagId = tag,
|
||||
Kind = NodeHierarchyKind.Equipment,
|
||||
};
|
||||
/// <summary>One scope resolving to one path.</summary>
|
||||
private static IReadOnlyDictionary<AclScopeRef, IReadOnlyList<NodeAclPath>> ScopePaths(
|
||||
params (NodeAclScopeKind Kind, string ScopeId, string[] Segments)[] entries) =>
|
||||
entries.ToDictionary(
|
||||
e => new AclScopeRef(e.Kind, e.ScopeId),
|
||||
e => (IReadOnlyList<NodeAclPath>)new[] { new NodeAclPath(e.Segments) });
|
||||
|
||||
/// <summary>A UNS-realm trie path: <c>uns / …segments…</c>.</summary>
|
||||
private static string[] UnsPath(params string[] segments) => [NodeAclRealms.Uns, .. segments];
|
||||
|
||||
/// <summary>A raw-realm trie path: <c>raw / …segments…</c>.</summary>
|
||||
private static string[] RawPath(params string[] segments) => [NodeAclRealms.Raw, .. segments];
|
||||
|
||||
/// <summary>A node in the UNS realm addressed by its path below the realm segment.</summary>
|
||||
private static NodeScope UnsScope(string cluster, params string[] segments) =>
|
||||
new() { ClusterId = cluster, Kind = NodeHierarchyKind.Uns, Segments = segments };
|
||||
|
||||
/// <summary>A node in the raw realm addressed by its path below the realm segment.</summary>
|
||||
private static NodeScope RawScope(string cluster, params string[] segments) =>
|
||||
new() { ClusterId = cluster, Kind = NodeHierarchyKind.Raw, Segments = segments };
|
||||
|
||||
/// <summary>Verifies cluster-level grant cascades to every tag.</summary>
|
||||
[Fact]
|
||||
public void ClusterLevelGrant_Cascades_ToEveryTag()
|
||||
{
|
||||
var rows = new[] { Row("cn=ops", NodeAclScopeKind.Cluster, scopeId: null, NodePermissions.Read) };
|
||||
var trie = PermissionTrieBuilder.Build("c1", 1, rows);
|
||||
var trie = PermissionTrieBuilder.Build("c1", 1, rows, NoScopePaths);
|
||||
|
||||
var matches = trie.CollectMatches(
|
||||
EquipmentTag("c1", "ns", "area1", "line1", "eq1", "tag1"),
|
||||
UnsScope("c1", "area1", "line1", "eq1", "tag1"),
|
||||
["cn=ops"]);
|
||||
|
||||
matches.Count.ShouldBe(1);
|
||||
@@ -53,38 +71,44 @@ public sealed class PermissionTrieTests
|
||||
[Fact]
|
||||
public void EquipmentScope_DoesNotLeak_ToSibling()
|
||||
{
|
||||
var paths = new Dictionary<string, NodeAclPath>(StringComparer.OrdinalIgnoreCase)
|
||||
{
|
||||
["eq-A"] = new(new[] { "ns", "area1", "line1", "eq-A" }),
|
||||
};
|
||||
var paths = ScopePaths(
|
||||
(NodeAclScopeKind.Equipment, "eq-A", UnsPath("area1", "line1", "eq-A")));
|
||||
var rows = new[] { Row("cn=ops", NodeAclScopeKind.Equipment, "eq-A", NodePermissions.Read) };
|
||||
var trie = PermissionTrieBuilder.Build("c1", 1, rows, paths);
|
||||
|
||||
var matchA = trie.CollectMatches(EquipmentTag("c1", "ns", "area1", "line1", "eq-A", "tag1"), ["cn=ops"]);
|
||||
var matchB = trie.CollectMatches(EquipmentTag("c1", "ns", "area1", "line1", "eq-B", "tag1"), ["cn=ops"]);
|
||||
var matchA = trie.CollectMatches(UnsScope("c1", "area1", "line1", "eq-A", "tag1"), ["cn=ops"]);
|
||||
var matchB = trie.CollectMatches(UnsScope("c1", "area1", "line1", "eq-B", "tag1"), ["cn=ops"]);
|
||||
|
||||
matchA.Count.ShouldBe(1);
|
||||
matchB.ShouldBeEmpty("grant at eq-A must not apply to sibling eq-B");
|
||||
}
|
||||
|
||||
/// <summary>Verifies multiple groups union their permission flags.</summary>
|
||||
/// <summary>
|
||||
/// Verifies that every principal-matching grant is collected once, with its own flags left
|
||||
/// untouched. <see cref="PermissionTrie.CollectMatches"/> deliberately does NOT combine the flag
|
||||
/// bits — the OR lives in <c>TriePermissionEvaluator.Authorize</c> and is pinned there by
|
||||
/// <c>TriePermissionEvaluatorTests.Union_Across_Levels_Ors_Flags_From_Every_Match</c>. (Renamed
|
||||
/// from <c>MultiGroup_Union_OrsPermissionFlags</c>, which OR-ed the flags in the test body and so
|
||||
/// asserted nothing about production behaviour.)
|
||||
/// </summary>
|
||||
[Fact]
|
||||
public void MultiGroup_Union_OrsPermissionFlags()
|
||||
public void MultiGroup_Matches_Are_Collected_PerGrant_Without_Combining()
|
||||
{
|
||||
var rows = new[]
|
||||
{
|
||||
Row("cn=readers", NodeAclScopeKind.Cluster, null, NodePermissions.Read),
|
||||
Row("cn=writers", NodeAclScopeKind.Cluster, null, NodePermissions.WriteOperate),
|
||||
};
|
||||
var trie = PermissionTrieBuilder.Build("c1", 1, rows);
|
||||
var trie = PermissionTrieBuilder.Build("c1", 1, rows, NoScopePaths);
|
||||
|
||||
var matches = trie.CollectMatches(
|
||||
EquipmentTag("c1", "ns", "area1", "line1", "eq1", "tag1"),
|
||||
UnsScope("c1", "area1", "line1", "eq1", "tag1"),
|
||||
["cn=readers", "cn=writers"]);
|
||||
|
||||
matches.Count.ShouldBe(2);
|
||||
var combined = matches.Aggregate(NodePermissions.None, (acc, m) => acc | m.PermissionFlags);
|
||||
combined.ShouldBe(NodePermissions.Read | NodePermissions.WriteOperate);
|
||||
matches.Select(m => m.Principal).ShouldBe(["cn=readers", "cn=writers"], ignoreOrder: true);
|
||||
matches.Single(m => m.Principal == "cn=readers").PermissionFlags.ShouldBe(NodePermissions.Read);
|
||||
matches.Single(m => m.Principal == "cn=writers").PermissionFlags.ShouldBe(NodePermissions.WriteOperate);
|
||||
}
|
||||
|
||||
/// <summary>Verifies no matching group returns empty.</summary>
|
||||
@@ -92,57 +116,52 @@ public sealed class PermissionTrieTests
|
||||
public void NoMatchingGroup_ReturnsEmpty()
|
||||
{
|
||||
var rows = new[] { Row("cn=different", NodeAclScopeKind.Cluster, null, NodePermissions.Read) };
|
||||
var trie = PermissionTrieBuilder.Build("c1", 1, rows);
|
||||
var trie = PermissionTrieBuilder.Build("c1", 1, rows, NoScopePaths);
|
||||
|
||||
var matches = trie.CollectMatches(
|
||||
EquipmentTag("c1", "ns", "area1", "line1", "eq1", "tag1"),
|
||||
UnsScope("c1", "area1", "line1", "eq1", "tag1"),
|
||||
["cn=ops"]);
|
||||
|
||||
matches.ShouldBeEmpty();
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Galaxy is now a standard Equipment-kind driver: Galaxy points are ordinary equipment
|
||||
/// tags, so a grant on a Galaxy equipment resolves via the Equipment walk and must not leak
|
||||
/// to a sibling Galaxy equipment.
|
||||
/// Galaxy is a standard Equipment-kind driver: Galaxy points are ordinary equipment tags, so a
|
||||
/// grant on a Galaxy equipment resolves via the UNS walk and must not leak to a sibling Galaxy
|
||||
/// equipment.
|
||||
/// </summary>
|
||||
[Fact]
|
||||
public void Galaxy_EquipmentScope_Grant_DoesNotLeak_To_Sibling_Equipment()
|
||||
{
|
||||
var paths = new Dictionary<string, NodeAclPath>(StringComparer.OrdinalIgnoreCase)
|
||||
{
|
||||
["gal-eq-A"] = new(new[] { "ns-gal", "area1", "line1", "gal-eq-A" }),
|
||||
};
|
||||
var paths = ScopePaths(
|
||||
(NodeAclScopeKind.Equipment, "gal-eq-A", UnsPath("area1", "line1", "gal-eq-A")));
|
||||
var rows = new[] { Row("cn=ops", NodeAclScopeKind.Equipment, "gal-eq-A", NodePermissions.Read) };
|
||||
var trie = PermissionTrieBuilder.Build("c1", 1, rows, paths);
|
||||
|
||||
var matchA = trie.CollectMatches(EquipmentTag("c1", "ns-gal", "area1", "line1", "gal-eq-A", "tag1"), ["cn=ops"]);
|
||||
var matchB = trie.CollectMatches(EquipmentTag("c1", "ns-gal", "area1", "line1", "gal-eq-B", "tag1"), ["cn=ops"]);
|
||||
var matchA = trie.CollectMatches(UnsScope("c1", "area1", "line1", "gal-eq-A", "tag1"), ["cn=ops"]);
|
||||
var matchB = trie.CollectMatches(UnsScope("c1", "area1", "line1", "gal-eq-B", "tag1"), ["cn=ops"]);
|
||||
|
||||
matchA.Count.ShouldBe(1);
|
||||
matchB.ShouldBeEmpty("grant at gal-eq-A must not apply to sibling gal-eq-B");
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// A grant on a Galaxy equipment tag is reported with its true Equipment-walk structural
|
||||
/// scope (Equipment), not a Galaxy-specific scope — Galaxy now flows through the same
|
||||
/// Equipment permission walk as every other equipment tag.
|
||||
/// A grant on a Galaxy equipment tag is reported with the authored row's Equipment scope kind —
|
||||
/// Galaxy flows through the same UNS permission walk as every other equipment tag.
|
||||
/// </summary>
|
||||
[Fact]
|
||||
public void Galaxy_EquipmentScope_Grant_Reports_Equipment_Scope()
|
||||
{
|
||||
var paths = new Dictionary<string, NodeAclPath>(StringComparer.OrdinalIgnoreCase)
|
||||
{
|
||||
["gal-eq"] = new(new[] { "ns-gal", "area1", "line1", "gal-eq" }),
|
||||
};
|
||||
var paths = ScopePaths(
|
||||
(NodeAclScopeKind.Equipment, "gal-eq", UnsPath("area1", "line1", "gal-eq")));
|
||||
var rows = new[] { Row("cn=ops", NodeAclScopeKind.Equipment, "gal-eq", NodePermissions.Read) };
|
||||
var trie = PermissionTrieBuilder.Build("c1", 1, rows, paths);
|
||||
|
||||
var matches = trie.CollectMatches(EquipmentTag("c1", "ns-gal", "area1", "line1", "gal-eq", "tag1"), ["cn=ops"]);
|
||||
var matches = trie.CollectMatches(UnsScope("c1", "area1", "line1", "gal-eq", "tag1"), ["cn=ops"]);
|
||||
|
||||
matches.Count.ShouldBe(1);
|
||||
matches[0].Scope.ShouldBe(NodeAclScopeKind.Equipment,
|
||||
"Galaxy equipment grants resolve via the Equipment walk and report Equipment scope");
|
||||
"Galaxy equipment grants resolve via the UNS walk and report the row's Equipment scope");
|
||||
}
|
||||
|
||||
/// <summary>Verifies cross-cluster grant does not leak.</summary>
|
||||
@@ -150,16 +169,21 @@ public sealed class PermissionTrieTests
|
||||
public void CrossCluster_Grant_DoesNotLeak()
|
||||
{
|
||||
var rows = new[] { Row("cn=ops", NodeAclScopeKind.Cluster, null, NodePermissions.Read, clusterId: "c-other") };
|
||||
var trie = PermissionTrieBuilder.Build("c1", 1, rows);
|
||||
var trie = PermissionTrieBuilder.Build("c1", 1, rows, NoScopePaths);
|
||||
|
||||
var matches = trie.CollectMatches(
|
||||
EquipmentTag("c1", "ns", "area1", "line1", "eq1", "tag1"),
|
||||
UnsScope("c1", "area1", "line1", "eq1", "tag1"),
|
||||
["cn=ops"]);
|
||||
|
||||
matches.ShouldBeEmpty("rows for cluster c-other must not land in c1's trie");
|
||||
}
|
||||
|
||||
/// <summary>Verifies build is idempotent.</summary>
|
||||
/// <summary>
|
||||
/// Verifies build is idempotent, against an <b>independent</b> expectation rather than by
|
||||
/// comparing one build's output to the other's. The previous form asserted
|
||||
/// <c>trie1.Count.ShouldBe(trie2.Count)</c>, which a <c>Build</c> that dropped every row passed as
|
||||
/// <c>0 == 0</c>; the absolute counts below go red the moment placement regresses.
|
||||
/// </summary>
|
||||
[Fact]
|
||||
public void Build_IsIdempotent()
|
||||
{
|
||||
@@ -167,13 +191,187 @@ public sealed class PermissionTrieTests
|
||||
{
|
||||
Row("cn=a", NodeAclScopeKind.Cluster, null, NodePermissions.Read),
|
||||
Row("cn=b", NodeAclScopeKind.Cluster, null, NodePermissions.WriteOperate),
|
||||
Row("cn=a", NodeAclScopeKind.Equipment, "eq-A", NodePermissions.WriteOperate),
|
||||
};
|
||||
var paths = ScopePaths(
|
||||
(NodeAclScopeKind.Equipment, "eq-A", UnsPath("area1", "line1", "eq-A")));
|
||||
var scope = UnsScope("c1", "area1", "line1", "eq-A", "tag1");
|
||||
|
||||
var trie1 = PermissionTrieBuilder.Build("c1", 1, rows);
|
||||
var trie2 = PermissionTrieBuilder.Build("c1", 1, rows);
|
||||
var trie1 = PermissionTrieBuilder.Build("c1", 1, rows, paths);
|
||||
var trie2 = PermissionTrieBuilder.Build("c1", 1, rows, paths);
|
||||
|
||||
trie1.Root.Grants.Count.ShouldBe(trie2.Root.Grants.Count);
|
||||
trie1.ClusterId.ShouldBe(trie2.ClusterId);
|
||||
trie1.GenerationId.ShouldBe(trie2.GenerationId);
|
||||
foreach (var trie in new[] { trie1, trie2 })
|
||||
{
|
||||
trie.ClusterId.ShouldBe("c1");
|
||||
trie.GenerationId.ShouldBe(1);
|
||||
trie.Root.Grants.Count.ShouldBe(2, "both cluster rows land at the root");
|
||||
trie.CollectMatches(scope, ["cn=a"]).Count.ShouldBe(2, "one cluster grant + the eq-A grant");
|
||||
trie.CollectMatches(scope, ["cn=b"]).Count.ShouldBe(1, "cn=b holds only the cluster grant");
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// A grant planted at a raw container matches a tag nested arbitrarily deep beneath it — two
|
||||
/// nested folders and two nested tag groups here — and does <b>not</b> match a sibling device.
|
||||
/// The sibling leg is the negative control: without it a walk that ignored
|
||||
/// <see cref="NodeScope.Segments"/> entirely would still pass the positive leg.
|
||||
/// </summary>
|
||||
[Fact]
|
||||
public void RawDevice_Grant_Matches_Deeply_Nested_Tag_And_Not_A_Sibling_Device()
|
||||
{
|
||||
var paths = ScopePaths(
|
||||
(NodeAclScopeKind.RawDevice, "dev-1", RawPath("Plant", "CellA", "Modbus", "dev1")));
|
||||
var rows = new[] { Row("cn=ops", NodeAclScopeKind.RawDevice, "dev-1", NodePermissions.Read) };
|
||||
var trie = PermissionTrieBuilder.Build("c1", 1, rows, paths);
|
||||
|
||||
// raw / Plant / CellA / Modbus / dev1 / Motors / Drive / Speed — 7 segments below the realm.
|
||||
var beneath = trie.CollectMatches(
|
||||
RawScope("c1", "Plant", "CellA", "Modbus", "dev1", "Motors", "Drive", "Speed"),
|
||||
["cn=ops"]);
|
||||
|
||||
var sibling = trie.CollectMatches(
|
||||
RawScope("c1", "Plant", "CellA", "Modbus", "dev2", "Motors", "Drive", "Speed"),
|
||||
["cn=ops"]);
|
||||
|
||||
beneath.Count.ShouldBe(1, "a container grant cascades to every node beneath it, at any depth");
|
||||
beneath[0].Scope.ShouldBe(NodeAclScopeKind.RawDevice);
|
||||
sibling.ShouldBeEmpty("grant at dev1 must not reach sibling device dev2");
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Regression guard for the <c>StringComparer.Ordinal</c> children comparer (#520 stage 3): a
|
||||
/// grant authored on <c>Speed</c> must not match a scope for <c>speed</c>. Raw sibling names are
|
||||
/// unique only under an ordinal comparer, so both spellings can exist under one device and the
|
||||
/// previous <c>OrdinalIgnoreCase</c> map silently granted one through the other. The positive leg
|
||||
/// is asserted alongside so the negative cannot pass by the walk simply never matching.
|
||||
/// </summary>
|
||||
[Fact]
|
||||
public void Segment_Matching_Is_Case_Sensitive()
|
||||
{
|
||||
var paths = ScopePaths(
|
||||
(NodeAclScopeKind.Tag, "tag-speed", RawPath("Plant", "Modbus", "dev1", "Speed")));
|
||||
var rows = new[] { Row("cn=ops", NodeAclScopeKind.Tag, "tag-speed", NodePermissions.Read) };
|
||||
var trie = PermissionTrieBuilder.Build("c1", 1, rows, paths);
|
||||
|
||||
var exact = trie.CollectMatches(RawScope("c1", "Plant", "Modbus", "dev1", "Speed"), ["cn=ops"]);
|
||||
var caseDrifted = trie.CollectMatches(RawScope("c1", "Plant", "Modbus", "dev1", "speed"), ["cn=ops"]);
|
||||
|
||||
exact.Count.ShouldBe(1, "the exact spelling must match, or the negative leg proves nothing");
|
||||
caseDrifted.ShouldBeEmpty(
|
||||
"segment matching is case-sensitive ordinal — 'Speed' and 'speed' are distinct raw siblings");
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Regression guard for the case-sensitive comparer on the <b>container</b> levels too: a grant
|
||||
/// under device <c>Dev1</c> must not cascade into a scope walking <c>dev1</c>.
|
||||
/// </summary>
|
||||
[Fact]
|
||||
public void Container_Segment_Matching_Is_Case_Sensitive()
|
||||
{
|
||||
var paths = ScopePaths(
|
||||
(NodeAclScopeKind.RawDevice, "dev-1", RawPath("Plant", "Modbus", "Dev1")));
|
||||
var rows = new[] { Row("cn=ops", NodeAclScopeKind.RawDevice, "dev-1", NodePermissions.Read) };
|
||||
var trie = PermissionTrieBuilder.Build("c1", 1, rows, paths);
|
||||
|
||||
trie.CollectMatches(RawScope("c1", "Plant", "Modbus", "Dev1", "Speed"), ["cn=ops"])
|
||||
.Count.ShouldBe(1);
|
||||
trie.CollectMatches(RawScope("c1", "Plant", "Modbus", "dev1", "Speed"), ["cn=ops"])
|
||||
.ShouldBeEmpty("a case-drifted container segment must not cascade");
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// The realm is a hard gate at level 1: a grant planted in the raw realm must not match a scope in
|
||||
/// the UNS realm, even when the segments below the realm are identical. This pins that the walk
|
||||
/// derives its level-1 key from <see cref="NodeScope.Kind"/> via
|
||||
/// <see cref="NodeAclRealms.SegmentFor(NodeHierarchyKind)"/> rather than skipping the level.
|
||||
/// </summary>
|
||||
[Fact]
|
||||
public void Grant_In_One_Realm_DoesNot_Match_A_Scope_In_The_Other()
|
||||
{
|
||||
var paths = ScopePaths(
|
||||
(NodeAclScopeKind.RawDevice, "dev-1", RawPath("Plant", "Modbus", "dev1")));
|
||||
var rows = new[] { Row("cn=ops", NodeAclScopeKind.RawDevice, "dev-1", NodePermissions.Read) };
|
||||
var trie = PermissionTrieBuilder.Build("c1", 1, rows, paths);
|
||||
|
||||
trie.CollectMatches(RawScope("c1", "Plant", "Modbus", "dev1", "Speed"), ["cn=ops"])
|
||||
.Count.ShouldBe(1, "the raw scope must match, or the cross-realm leg proves nothing");
|
||||
trie.CollectMatches(UnsScope("c1", "Plant", "Modbus", "dev1", "Speed"), ["cn=ops"])
|
||||
.ShouldBeEmpty("a raw-realm grant must not be reachable from a UNS scope");
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// A <see cref="NodeAclScopeKind.Namespace"/> row planted at the realm segment itself grants every
|
||||
/// node in that realm and nothing in the other one.
|
||||
/// </summary>
|
||||
[Fact]
|
||||
public void NamespaceScope_Grant_Covers_Its_Realm_Only()
|
||||
{
|
||||
var paths = ScopePaths(
|
||||
(NodeAclScopeKind.Namespace, NodeAclRealms.Raw, [NodeAclRealms.Raw]));
|
||||
var rows = new[] { Row("cn=ops", NodeAclScopeKind.Namespace, NodeAclRealms.Raw, NodePermissions.Read) };
|
||||
var trie = PermissionTrieBuilder.Build("c1", 1, rows, paths);
|
||||
|
||||
var inRaw = trie.CollectMatches(RawScope("c1", "Plant", "Modbus", "dev1", "Speed"), ["cn=ops"]);
|
||||
var inUns = trie.CollectMatches(UnsScope("c1", "area1", "line1", "eq1", "tag1"), ["cn=ops"]);
|
||||
|
||||
inRaw.Count.ShouldBe(1);
|
||||
inRaw[0].Scope.ShouldBe(NodeAclScopeKind.Namespace);
|
||||
inUns.ShouldBeEmpty("a raw-namespace grant must not cover the UNS realm");
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Provenance is the granting <b>row's</b> <see cref="NodeAclScopeKind"/>, not one derived from the
|
||||
/// structural depth the grant sits at. Two rows of different kinds planted at the same trie node
|
||||
/// must report their own kinds — under any depth-derived scheme they would report the same one.
|
||||
/// </summary>
|
||||
[Fact]
|
||||
public void MatchedGrant_Reports_The_Rows_Own_ScopeKind_Not_A_Depth_Derived_One()
|
||||
{
|
||||
var samePath = RawPath("Plant", "Modbus", "dev1");
|
||||
var paths = new Dictionary<AclScopeRef, IReadOnlyList<NodeAclPath>>
|
||||
{
|
||||
[new AclScopeRef(NodeAclScopeKind.RawDevice, "dev-1")] = new[] { new NodeAclPath(samePath) },
|
||||
[new AclScopeRef(NodeAclScopeKind.RawTagGroup, "grp-1")] = new[] { new NodeAclPath(samePath) },
|
||||
};
|
||||
var rows = new[]
|
||||
{
|
||||
Row("cn=ops", NodeAclScopeKind.RawDevice, "dev-1", NodePermissions.Read),
|
||||
Row("cn=ops", NodeAclScopeKind.RawTagGroup, "grp-1", NodePermissions.WriteOperate),
|
||||
};
|
||||
var trie = PermissionTrieBuilder.Build("c1", 1, rows, paths);
|
||||
|
||||
var matches = trie.CollectMatches(RawScope("c1", "Plant", "Modbus", "dev1", "Speed"), ["cn=ops"]);
|
||||
|
||||
matches.Count.ShouldBe(2);
|
||||
matches.Select(m => m.Scope).ShouldBe(
|
||||
[NodeAclScopeKind.RawDevice, NodeAclScopeKind.RawTagGroup],
|
||||
ignoreOrder: true,
|
||||
"each grant carries the scope kind its own row was authored with");
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// A scope addressing the realm itself (no segments) collects the realm-level and cluster-level
|
||||
/// grants and nothing planted below it.
|
||||
/// </summary>
|
||||
[Fact]
|
||||
public void RealmScope_With_No_Segments_Collects_Only_Cluster_And_Realm_Grants()
|
||||
{
|
||||
var paths = ScopePaths(
|
||||
(NodeAclScopeKind.Namespace, NodeAclRealms.Raw, [NodeAclRealms.Raw]),
|
||||
(NodeAclScopeKind.RawDevice, "dev-1", RawPath("Plant", "Modbus", "dev1")));
|
||||
var rows = new[]
|
||||
{
|
||||
Row("cn=ops", NodeAclScopeKind.Cluster, null, NodePermissions.Browse),
|
||||
Row("cn=ops", NodeAclScopeKind.Namespace, NodeAclRealms.Raw, NodePermissions.Read),
|
||||
Row("cn=ops", NodeAclScopeKind.RawDevice, "dev-1", NodePermissions.WriteOperate),
|
||||
};
|
||||
var trie = PermissionTrieBuilder.Build("c1", 1, rows, paths);
|
||||
|
||||
var matches = trie.CollectMatches(RawScope("c1"), ["cn=ops"]);
|
||||
|
||||
matches.Select(m => m.Scope).ShouldBe(
|
||||
[NodeAclScopeKind.Cluster, NodeAclScopeKind.Namespace],
|
||||
ignoreOrder: true,
|
||||
"the device grant sits below the realm and must not be collected at the realm");
|
||||
}
|
||||
}
|
||||
|
||||
+174
-11
@@ -13,6 +13,9 @@ public sealed class TriePermissionEvaluatorTests
|
||||
private static readonly DateTime Now = new(2026, 4, 19, 12, 0, 0, DateTimeKind.Utc);
|
||||
private readonly FakeTimeProvider _time = new();
|
||||
|
||||
private static readonly IReadOnlyDictionary<AclScopeRef, IReadOnlyList<NodeAclPath>> NoScopePaths =
|
||||
new Dictionary<AclScopeRef, IReadOnlyList<NodeAclPath>>();
|
||||
|
||||
private sealed class FakeTimeProvider : TimeProvider
|
||||
{
|
||||
/// <summary>Gets or sets the current UTC time.</summary>
|
||||
@@ -46,22 +49,42 @@ public sealed class TriePermissionEvaluatorTests
|
||||
MembershipVersion = 1,
|
||||
};
|
||||
|
||||
/// <summary>One scope resolving to one path.</summary>
|
||||
private static IReadOnlyDictionary<AclScopeRef, IReadOnlyList<NodeAclPath>> ScopePaths(
|
||||
params (NodeAclScopeKind Kind, string ScopeId, string[] Segments)[] entries) =>
|
||||
entries.ToDictionary(
|
||||
e => new AclScopeRef(e.Kind, e.ScopeId),
|
||||
e => (IReadOnlyList<NodeAclPath>)new[] { new NodeAclPath(e.Segments) });
|
||||
|
||||
/// <summary>A UNS-realm trie path: <c>uns / …segments…</c>.</summary>
|
||||
private static string[] UnsPath(params string[] segments) => [NodeAclRealms.Uns, .. segments];
|
||||
|
||||
/// <summary>A raw-realm trie path: <c>raw / …segments…</c>.</summary>
|
||||
private static string[] RawPath(params string[] segments) => [NodeAclRealms.Raw, .. segments];
|
||||
|
||||
/// <summary>The default UNS node the flag/staleness/generation tests evaluate against.</summary>
|
||||
private static NodeScope Scope(string cluster = "c1") =>
|
||||
new()
|
||||
{
|
||||
ClusterId = cluster,
|
||||
NamespaceId = "ns",
|
||||
UnsAreaId = "area",
|
||||
UnsLineId = "line",
|
||||
EquipmentId = "eq",
|
||||
TagId = "tag",
|
||||
Kind = NodeHierarchyKind.Equipment,
|
||||
Kind = NodeHierarchyKind.Uns,
|
||||
Segments = ["area", "line", "eq", "tag"],
|
||||
};
|
||||
|
||||
private TriePermissionEvaluator MakeEvaluator(NodeAcl[] rows)
|
||||
/// <summary>A node in the UNS realm addressed by its path below the realm segment.</summary>
|
||||
private static NodeScope UnsScope(string cluster, params string[] segments) =>
|
||||
new() { ClusterId = cluster, Kind = NodeHierarchyKind.Uns, Segments = segments };
|
||||
|
||||
/// <summary>A node in the raw realm addressed by its path below the realm segment.</summary>
|
||||
private static NodeScope RawScope(string cluster, params string[] segments) =>
|
||||
new() { ClusterId = cluster, Kind = NodeHierarchyKind.Raw, Segments = segments };
|
||||
|
||||
private TriePermissionEvaluator MakeEvaluator(
|
||||
NodeAcl[] rows,
|
||||
IReadOnlyDictionary<AclScopeRef, IReadOnlyList<NodeAclPath>>? scopePaths = null)
|
||||
{
|
||||
var cache = new PermissionTrieCache();
|
||||
cache.Install(PermissionTrieBuilder.Build("c1", 1, rows));
|
||||
cache.Install(PermissionTrieBuilder.Build("c1", 1, rows, scopePaths ?? NoScopePaths));
|
||||
return new TriePermissionEvaluator(cache, _time);
|
||||
}
|
||||
|
||||
@@ -160,8 +183,8 @@ public sealed class TriePermissionEvaluatorTests
|
||||
// The evaluator must still honour the session's bound generation 1, not generation 2.
|
||||
var gen1Row = Row("cn=ops", NodeAclScopeKind.Cluster, null, NodePermissions.Read);
|
||||
var cache = new PermissionTrieCache();
|
||||
cache.Install(PermissionTrieBuilder.Build("c1", 1, [gen1Row]));
|
||||
cache.Install(PermissionTrieBuilder.Build("c1", 2, [])); // gen 2 — grant revoked, now current
|
||||
cache.Install(PermissionTrieBuilder.Build("c1", 1, [gen1Row], NoScopePaths));
|
||||
cache.Install(PermissionTrieBuilder.Build("c1", 2, [], NoScopePaths)); // gen 2 — grant revoked, now current
|
||||
var evaluator = new TriePermissionEvaluator(cache, _time);
|
||||
|
||||
var decision = evaluator.Authorize(
|
||||
@@ -180,7 +203,7 @@ public sealed class TriePermissionEvaluatorTests
|
||||
// The evaluator must fail closed rather than silently using the current generation.
|
||||
var gen5Row = Row("cn=ops", NodeAclScopeKind.Cluster, null, NodePermissions.Read);
|
||||
var cache = new PermissionTrieCache();
|
||||
cache.Install(PermissionTrieBuilder.Build("c1", 5, [gen5Row]));
|
||||
cache.Install(PermissionTrieBuilder.Build("c1", 5, [gen5Row], NoScopePaths));
|
||||
var evaluator = new TriePermissionEvaluator(cache, _time);
|
||||
|
||||
// Session bound to generation 1, which was never installed / has been pruned.
|
||||
@@ -234,4 +257,144 @@ public sealed class TriePermissionEvaluatorTests
|
||||
TriePermissionEvaluator.MapOperationToPermission(op);
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// End-to-end coverage of the sub-cluster walk: an Equipment-scoped grant authorizes a node
|
||||
/// beneath that equipment, and denies the same operation on a sibling equipment. Every other test
|
||||
/// in this class uses a cluster-scoped grant, which the walk collects at level 0 before it ever
|
||||
/// descends — so without this pair nothing here exercises <see cref="NodeScope.Segments"/> at all.
|
||||
/// </summary>
|
||||
[Fact]
|
||||
public void SubCluster_Grant_Allows_Beneath_Its_Equipment_And_Denies_A_Sibling()
|
||||
{
|
||||
var evaluator = MakeEvaluator(
|
||||
[Row("cn=ops", NodeAclScopeKind.Equipment, "eq-A", NodePermissions.WriteOperate)],
|
||||
ScopePaths((NodeAclScopeKind.Equipment, "eq-A", UnsPath("area-1", "line-1", "eq-A"))));
|
||||
|
||||
var onEquipment = evaluator.Authorize(
|
||||
Session(["cn=ops"]), OpcUaOperation.WriteOperate,
|
||||
UnsScope("c1", "area-1", "line-1", "eq-A", "Setpoint"));
|
||||
|
||||
var onSibling = evaluator.Authorize(
|
||||
Session(["cn=ops"]), OpcUaOperation.WriteOperate,
|
||||
UnsScope("c1", "area-1", "line-1", "eq-B", "Setpoint"));
|
||||
|
||||
onEquipment.IsAllowed.ShouldBeTrue("the grant sits on the equipment the scope walks through");
|
||||
onEquipment.Provenance.Count.ShouldBe(1);
|
||||
onEquipment.Provenance[0].Scope.ShouldBe(NodeAclScopeKind.Equipment);
|
||||
onSibling.IsAllowed.ShouldBeFalse("a grant on eq-A must not authorize eq-B");
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// The same walk through the raw realm, over a path deep enough to have nested folders and nested
|
||||
/// tag groups: a grant on the device authorizes a tag six levels below it, and not the sibling
|
||||
/// device's tag.
|
||||
/// </summary>
|
||||
[Fact]
|
||||
public void SubCluster_Grant_Walks_A_Deep_Raw_Path()
|
||||
{
|
||||
var evaluator = MakeEvaluator(
|
||||
[Row("cn=ops", NodeAclScopeKind.RawDevice, "dev-1", NodePermissions.Read)],
|
||||
ScopePaths((NodeAclScopeKind.RawDevice, "dev-1", RawPath("Plant", "CellA", "Modbus", "dev1"))));
|
||||
|
||||
var beneath = evaluator.Authorize(
|
||||
Session(["cn=ops"]), OpcUaOperation.Read,
|
||||
RawScope("c1", "Plant", "CellA", "Modbus", "dev1", "Motors", "Drive", "Speed"));
|
||||
|
||||
var sibling = evaluator.Authorize(
|
||||
Session(["cn=ops"]), OpcUaOperation.Read,
|
||||
RawScope("c1", "Plant", "CellA", "Modbus", "dev2", "Motors", "Drive", "Speed"));
|
||||
|
||||
beneath.IsAllowed.ShouldBeTrue();
|
||||
beneath.Provenance[0].Scope.ShouldBe(NodeAclScopeKind.RawDevice,
|
||||
"provenance names the row's own kind, not one derived from the depth it was planted at");
|
||||
sibling.IsAllowed.ShouldBeFalse("the grant is anchored at dev1");
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// The permission OR lives here, in <c>Authorize</c>: flags from grants matched at different trie
|
||||
/// levels combine into one bitmask. Both legs are asserted with the same session and scope, so
|
||||
/// neither "use the first match" nor "use the last match" can pass.
|
||||
/// </summary>
|
||||
[Fact]
|
||||
public void Union_Across_Levels_Ors_Flags_From_Every_Match()
|
||||
{
|
||||
var evaluator = MakeEvaluator(
|
||||
[
|
||||
Row("cn=ops", NodeAclScopeKind.Cluster, null, NodePermissions.Read),
|
||||
Row("cn=ops", NodeAclScopeKind.Equipment, "eq-A", NodePermissions.WriteOperate),
|
||||
],
|
||||
ScopePaths((NodeAclScopeKind.Equipment, "eq-A", UnsPath("area-1", "line-1", "eq-A"))));
|
||||
|
||||
var scope = UnsScope("c1", "area-1", "line-1", "eq-A", "Setpoint");
|
||||
|
||||
evaluator.Authorize(Session(["cn=ops"]), OpcUaOperation.Read, scope)
|
||||
.IsAllowed.ShouldBeTrue("Read comes from the cluster-level grant");
|
||||
evaluator.Authorize(Session(["cn=ops"]), OpcUaOperation.WriteOperate, scope)
|
||||
.IsAllowed.ShouldBeTrue("WriteOperate comes from the equipment-level grant");
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// The union also spans principals: a session carrying two principals gets the OR of both their
|
||||
/// grants, and neither principal alone carries both permissions.
|
||||
/// </summary>
|
||||
[Fact]
|
||||
public void Union_Across_Principals_Ors_Flags()
|
||||
{
|
||||
NodeAcl[] rows =
|
||||
[
|
||||
Row("cn=readers", NodeAclScopeKind.Cluster, null, NodePermissions.Read),
|
||||
Row("cn=writers", NodeAclScopeKind.Cluster, null, NodePermissions.WriteOperate),
|
||||
];
|
||||
var evaluator = MakeEvaluator(rows);
|
||||
|
||||
evaluator.Authorize(Session(["cn=readers", "cn=writers"]), OpcUaOperation.WriteOperate, Scope())
|
||||
.IsAllowed.ShouldBeTrue();
|
||||
evaluator.Authorize(Session(["cn=readers", "cn=writers"]), OpcUaOperation.Read, Scope())
|
||||
.IsAllowed.ShouldBeTrue();
|
||||
evaluator.Authorize(Session(["cn=readers"]), OpcUaOperation.WriteOperate, Scope())
|
||||
.IsAllowed.ShouldBeFalse("cn=readers alone carries no write bit");
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// A grant resolved into the raw realm must not authorize the UNS node of the same name. The realm
|
||||
/// is level 1 of the walk and is derived from <see cref="NodeScope.Kind"/>, so a scope in the wrong
|
||||
/// realm never reaches the grant.
|
||||
/// </summary>
|
||||
[Fact]
|
||||
public void Grant_In_The_Raw_Realm_DoesNot_Authorize_A_Uns_Scope()
|
||||
{
|
||||
var evaluator = MakeEvaluator(
|
||||
[Row("cn=ops", NodeAclScopeKind.RawDevice, "dev-1", NodePermissions.Read)],
|
||||
ScopePaths((NodeAclScopeKind.RawDevice, "dev-1", RawPath("Plant", "Modbus", "dev1"))));
|
||||
|
||||
evaluator.Authorize(Session(["cn=ops"]), OpcUaOperation.Read,
|
||||
RawScope("c1", "Plant", "Modbus", "dev1", "Speed"))
|
||||
.IsAllowed.ShouldBeTrue("the raw scope must be allowed, or the cross-realm leg proves nothing");
|
||||
|
||||
evaluator.Authorize(Session(["cn=ops"]), OpcUaOperation.Read,
|
||||
UnsScope("c1", "Plant", "Modbus", "dev1", "Speed"))
|
||||
.IsAllowed.ShouldBeFalse("a raw-realm grant must not be reachable from a UNS scope");
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// A case-drifted scope segment must not reach a grant — the trie's children compare with
|
||||
/// <see cref="StringComparer.Ordinal"/>, matching OPC UA NodeId identity, so <c>Speed</c> and
|
||||
/// <c>speed</c> are distinct nodes and a grant on one denies the other.
|
||||
/// </summary>
|
||||
[Fact]
|
||||
public void Case_Drifted_Scope_Segment_Is_NotGranted()
|
||||
{
|
||||
var evaluator = MakeEvaluator(
|
||||
[Row("cn=ops", NodeAclScopeKind.Tag, "tag-speed", NodePermissions.Read)],
|
||||
ScopePaths((NodeAclScopeKind.Tag, "tag-speed", RawPath("Plant", "Modbus", "dev1", "Speed"))));
|
||||
|
||||
evaluator.Authorize(Session(["cn=ops"]), OpcUaOperation.Read,
|
||||
RawScope("c1", "Plant", "Modbus", "dev1", "Speed"))
|
||||
.IsAllowed.ShouldBeTrue();
|
||||
|
||||
evaluator.Authorize(Session(["cn=ops"]), OpcUaOperation.Read,
|
||||
RawScope("c1", "Plant", "Modbus", "dev1", "speed"))
|
||||
.IsAllowed.ShouldBeFalse("segment matching is case-sensitive ordinal");
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user