fix(mesh-phase4): driver-only nodes map LDAP groups from appsettings (no ConfigDb grants)

Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW
2026-07-23 11:44:44 -04:00
parent a41582ea6a
commit 833e45db9c
3 changed files with 121 additions and 2 deletions
@@ -72,6 +72,27 @@ public sealed class OtOpcUaGroupRoleMapperTests
        result.Roles.ShouldBeEmpty();
    }

+    [Fact]
+    public async Task Driver_only_node_falls_back_to_appsettings_baseline_via_null_mapping_service()
+    {
+        // Simulates a driver-only node: no ConfigDb, so ILdapGroupRoleMappingService is bound to
+        // NullLdapGroupRoleMappingService instead of the EF-backed one. MapAsync must still resolve
+        // roles from Security:Ldap:GroupToRole alone, and must not throw for lack of a DB.
+        var options = Options.Create(new LdapOptions
+        {
+            GroupToRole = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase)
+            {
+                ["operators"] = "WriteOperate",
+            },
+        });
+        var mapper = new OtOpcUaGroupRoleMapper(options, new NullLdapGroupRoleMappingService());
+
+        var result = await mapper.MapAsync(["operators", "unmapped-group"], CancellationToken.None);
+
+        result.Roles.ShouldBe(["WriteOperate"]);
+        result.Scope.ShouldBeNull();
+    }
+
    [Fact]
    public async Task Reproduces_RoleMapper_Map_plus_Merge_for_representative_inputs()
    {
@@ -116,3 +137,49 @@ public sealed class OtOpcUaGroupRoleMapperTests
            => throw new NotSupportedException();
    }
 }
+
+/// <summary>
+///     Proves <see cref="NullLdapGroupRoleMappingService"/> — the driver-only-node stand-in for the
+///     EF-backed <c>ILdapGroupRoleMappingService</c> — always reports "no DB grants" rather than
+///     throwing on the hot sign-in path, while its control-plane write surface (never called
+///     without an AdminUI) fails loudly instead of silently no-opping.
+/// </summary>
+public sealed class NullLdapGroupRoleMappingServiceTests
+{
+    [Fact]
+    public async Task GetByGroupsAsync_returns_empty()
+    {
+        var sut = new NullLdapGroupRoleMappingService();
+
+        var result = await sut.GetByGroupsAsync(["any-group"], CancellationToken.None);
+
+        result.ShouldBeEmpty();
+    }
+
+    [Fact]
+    public async Task ListAllAsync_returns_empty()
+    {
+        var sut = new NullLdapGroupRoleMappingService();
+
+        var result = await sut.ListAllAsync(CancellationToken.None);
+
+        result.ShouldBeEmpty();
+    }
+
+    [Fact]
+    public async Task CreateAsync_throws_NotSupportedException()
+    {
+        var sut = new NullLdapGroupRoleMappingService();
+        var row = new LdapGroupRoleMapping { LdapGroup = "g", Role = AdminRole.Administrator, IsSystemWide = true };
+
+        await Should.ThrowAsync<NotSupportedException>(() => sut.CreateAsync(row, CancellationToken.None));
+    }
+
+    [Fact]
+    public async Task DeleteAsync_throws_NotSupportedException()
+    {
+        var sut = new NullLdapGroupRoleMappingService();
+
+        await Should.ThrowAsync<NotSupportedException>(() => sut.DeleteAsync(Guid.NewGuid(), CancellationToken.None));
+    }
+}