fix(mesh-phase4): driver-only nodes map LDAP groups from appsettings (no ConfigDb grants)

Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW
2026-07-23 11:44:44 -04:00
parent a41582ea6a
commit 833e45db9c
3 changed files with 121 additions and 2 deletions
@@ -0,0 +1,44 @@
+using ZB.MOM.WW.OtOpcUa.Configuration.Entities;
+using ZB.MOM.WW.OtOpcUa.Configuration.Services;
+
+namespace ZB.MOM.WW.OtOpcUa.Security.Ldap;
+
+/// <summary>
+///     Driver-only-node stand-in for the EF-backed <see cref="ILdapGroupRoleMappingService"/>.
+///     A driver-only node (Akka role <c>driver</c>, not <c>admin</c>) has no ConfigDb connection
+///     (Phase 4 gated <c>AddOtOpcUaConfigDb</c> on <c>hasAdmin</c>), so it can never read the
+///     control-plane <c>LdapGroupRoleMapping</c> DB grants that <see cref="OtOpcUaGroupRoleMapper"/>
+///     normally unions into its result. This implementation always reports "no DB grants" so the
+///     data-path mapper falls back to exactly the appsettings <c>Security:Ldap:GroupToRole</c>
+///     baseline — the same safe fallback the mapper already takes when the real service simply
+///     has no matching rows. <see cref="LdapGroupRoleMapping"/> rows are not composed into the
+///     deployment artifact either, so a driver node never had DB grants via config; reporting
+///     empty here is honest, not lossy.
+/// </summary>
+/// <remarks>
+///     The write surface (<see cref="CreateAsync"/>/<see cref="DeleteAsync"/>) is control-plane-only
+///     Admin UI functionality that a driver-only node — which has no Admin UI — never calls. It
+///     throws rather than silently no-opping so an accidental call surfaces immediately instead of
+///     pretending to persist a grant that a driver-only node cannot store.
+/// </remarks>
+public sealed class NullLdapGroupRoleMappingService : ILdapGroupRoleMappingService
+{
+    /// <inheritdoc />
+    public Task<IReadOnlyList<LdapGroupRoleMapping>> GetByGroupsAsync(
+        IEnumerable<string> ldapGroups, CancellationToken cancellationToken)
+        => Task.FromResult<IReadOnlyList<LdapGroupRoleMapping>>(Array.Empty<LdapGroupRoleMapping>());
+
+    /// <inheritdoc />
+    public Task<IReadOnlyList<LdapGroupRoleMapping>> ListAllAsync(CancellationToken cancellationToken)
+        => Task.FromResult<IReadOnlyList<LdapGroupRoleMapping>>(Array.Empty<LdapGroupRoleMapping>());
+
+    /// <inheritdoc />
+    public Task<LdapGroupRoleMapping> CreateAsync(LdapGroupRoleMapping row, CancellationToken cancellationToken)
+        => throw new NotSupportedException(
+            "LDAP group-role grants are control-plane only; a driver-only node has no ConfigDb.");
+
+    /// <inheritdoc />
+    public Task DeleteAsync(Guid id, CancellationToken cancellationToken)
+        => throw new NotSupportedException(
+            "LDAP group-role grants are control-plane only; a driver-only node has no ConfigDb.");
+}