feat(security): author ACL grants from the real tree, not free text (#520 stage 7)
The last stage of #520. Enforcement landed in stages 5-6; this closes the authoring end, where a grant could be saved, deployed and sealed green while resolving to nothing. Scope kind and scope target are now chosen TOGETHER from a picker over the cluster's raw and UNS trees (AclScopePickerModal -> AclScopeTree, backed by IAclScopeService). They were previously an unrelated dropdown and a free-text box, so "RawDevice + a TagId" was a well-formed row. Because the trees are rooted at the grant's own cluster and each node supplies its own kind, NodeAclScopeCrossCluster, NodeAclScopeIdUnexpected, NodeAclScopeIdMissing and NodeAclScopeKindRetired all become unauthorable by construction. CheckScopeAsync mirrors DraftValidator.ValidateNodeAclScopes rule for rule and blocks the save when a scope resolves to nothing - re-checked on submit, not trusted from form load, because a row whose entity was deleted since is exactly where the operator never touches the picker. The list page marks such rows unresolved with the reason. The principal field suggests known principals and reports how many live keys reach the one typed; reaching nobody warns rather than blocks, since authoring ahead of minting is legitimate. Deliberate departures from the plan line, all recorded in the design doc: - The banners are reshaped, not removed. "Not enforced" stopped being true at stage 6, but enforcement is still a per-node flag the AdminUI cannot see, so a narrow grant really does confer nothing on a default-configured node. - A Cluster row produces a NULL ScopeId. The deploy gate rejects one that carries an id, so filling in the cluster id would author undeployable rows. - AclScopeTree is a new component rather than a third mode on RawTree, which already carries the /raw editing tree and the equipment reference picker. - UNS tags are not offered: a UNS signal is a UnsTagReference, and a Tag grant already covers the raw node and every UNS projection of it. Also fixed: the ACL editor had a DataAnnotationsValidator and no ValidationSummary, so an invalid NodeAclId made Create a silent no-op. Tests: 30 in AdminUI.Tests/Acls, falsified with six production mutations - each turned exactly the intended tests red and no others. Live gate PASSED on docker-dev, 11 legs; both central containers asserted on the same image by container id. The pair that matters is legs 8 and 11: the page and the deploy gate reject the same row with the same reason. Legs 5 and 9 are the positive controls - without them the gate passes against a page that refuses everything. Not covered: UNS-realm scope selection (SITE-A has no UNS areas). Rig restored to zero ACL rows. Claude-Session: https://claude.ai/code/session_015p7wGqy3YpZNCpDzTpGMKo
This commit is contained in:
Joseph Doherty
@@ -0,0 +1,111 @@
|
||||
using ZB.MOM.WW.OtOpcUa.AdminUI.Uns;
|
||||
using ZB.MOM.WW.OtOpcUa.Configuration.Enums;
|
||||
|
||||
namespace ZB.MOM.WW.OtOpcUa.AdminUI.Acls;
|
||||
|
||||
/// <summary>
|
||||
/// One row in the ACL scope picker (#520 stage 7) — a place a <c>NodeAcl</c> grant can be scoped at,
|
||||
/// in either the raw device tree or the UNS tree.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// <para>
|
||||
/// <b>Why a third tree view-model rather than reusing <see cref="RawNode"/>.</b> The picker's job is
|
||||
/// to produce a <see cref="NodeAclScopeKind"/> and a <c>ScopeId</c> <i>together</i>, from both
|
||||
/// hierarchies, in one list. <see cref="RawNode"/> covers only the raw side and <see cref="UnsNode"/>
|
||||
/// only the UNS side, and neither carries a scope kind — so a shared shape is what lets one renderer
|
||||
/// and one selection model serve both. The raw side keeps its lazy loading by carrying its source
|
||||
/// node in <see cref="RawSource"/>.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// A node with a null <see cref="ScopeKind"/> is a label only (the enterprise/cluster heading rows,
|
||||
/// and UNS tag rows — see <see cref="IAclScopeService"/> for why those are deliberately not
|
||||
/// selectable).
|
||||
/// </para>
|
||||
/// </remarks>
|
||||
public sealed class AclScopeNode
|
||||
{
|
||||
/// <summary>Gets the stable per-node key, unique within the picker tree.</summary>
|
||||
public required string Key { get; init; }
|
||||
|
||||
/// <summary>Gets the label shown in the tree.</summary>
|
||||
public required string DisplayName { get; init; }
|
||||
|
||||
/// <summary>Gets the leading glyph, matching the icon vocabulary of the /raw and /uns trees.</summary>
|
||||
public required string Icon { get; init; }
|
||||
|
||||
/// <summary>
|
||||
/// Gets the scope kind this row grants at, or <see langword="null"/> when the row is a label that
|
||||
/// cannot be selected.
|
||||
/// </summary>
|
||||
public NodeAclScopeKind? ScopeKind { get; init; }
|
||||
|
||||
/// <summary>
|
||||
/// Gets the <c>NodeAcl.ScopeId</c> this row produces. Null for a <see cref="NodeAclScopeKind.Cluster"/>
|
||||
/// row, which covers its whole cluster and carries no id, and for a label row.
|
||||
/// </summary>
|
||||
public string? ScopeId { get; init; }
|
||||
|
||||
/// <summary>Gets the ancestry label shown once selected, e.g. <c>Plant / Modbus / dev1</c>.</summary>
|
||||
public required string PathLabel { get; init; }
|
||||
|
||||
/// <summary>Gets a value indicating whether this node's children load on first expand.</summary>
|
||||
public bool HasLazyChildren { get; init; }
|
||||
|
||||
/// <summary>Gets the eagerly-materialised children (the whole UNS side; the raw side's roots only).</summary>
|
||||
public List<AclScopeNode> Children { get; } = new();
|
||||
|
||||
/// <summary>
|
||||
/// Gets the raw-tree node this row projects, when there is one. The picker hands it back to
|
||||
/// <see cref="IAclScopeService.LoadChildrenAsync"/> to expand the next level; null on the UNS side,
|
||||
/// which is loaded whole.
|
||||
/// </summary>
|
||||
public RawNode? RawSource { get; init; }
|
||||
|
||||
// --- Transient UI state (never persisted) ---
|
||||
|
||||
/// <summary>Gets or sets a value indicating whether the node is expanded.</summary>
|
||||
public bool Expanded { get; set; }
|
||||
|
||||
/// <summary>Gets or sets a value indicating whether the lazy children have been loaded.</summary>
|
||||
public bool Loaded { get; set; }
|
||||
|
||||
/// <summary>Gets or sets a value indicating whether a lazy load is in flight.</summary>
|
||||
public bool Loading { get; set; }
|
||||
|
||||
/// <summary>Gets or sets the last load error, if any.</summary>
|
||||
public string? Error { get; set; }
|
||||
|
||||
/// <summary>Gets a value indicating whether this row can be chosen as a grant scope.</summary>
|
||||
public bool Selectable => ScopeKind is not null;
|
||||
}
|
||||
|
||||
/// <summary>The two scope trees for one cluster, as the picker shows them.</summary>
|
||||
/// <param name="Raw">The raw device tree, rooted at the cluster; empty when the cluster is unknown.</param>
|
||||
/// <param name="Uns">The UNS tree (area → line → equipment) for the same cluster.</param>
|
||||
public readonly record struct AclScopeRoots(
|
||||
IReadOnlyList<AclScopeNode> Raw,
|
||||
IReadOnlyList<AclScopeNode> Uns);
|
||||
|
||||
/// <summary>
|
||||
/// The outcome of resolving one authored <c>(ScopeKind, ScopeId)</c> pair against the current
|
||||
/// configuration — the authoring-time mirror of the deploy gate's <c>NodeAclScope*</c> rules.
|
||||
/// </summary>
|
||||
/// <param name="Ok">Whether the scope names something the grant can actually be evaluated against.</param>
|
||||
/// <param name="Message">
|
||||
/// What it resolves to when <paramref name="Ok"/>, or what is wrong and how to fix it when not.
|
||||
/// </param>
|
||||
public readonly record struct AclScopeCheck(bool Ok, string Message);
|
||||
|
||||
/// <summary>How many API keys a principal name currently reaches.</summary>
|
||||
/// <param name="IsAnonymous">Whether this is the reserved <c>anonymous</c> principal, which has no key.</param>
|
||||
/// <param name="EnabledKeys">Enabled, unexpired keys authenticating as this principal.</param>
|
||||
/// <param name="DisabledKeys">Keys naming this principal that are disabled or already expired.</param>
|
||||
public readonly record struct PrincipalUsage(bool IsAnonymous, int EnabledKeys, int DisabledKeys)
|
||||
{
|
||||
/// <summary>
|
||||
/// Gets a value indicating whether anything can currently present this principal. False means the
|
||||
/// grant is authored against nobody — which is legitimate while a key is still to be minted, and a
|
||||
/// typo otherwise, so it is surfaced rather than blocked.
|
||||
/// </summary>
|
||||
public bool ReachesSomething => IsAnonymous || EnabledKeys > 0;
|
||||
}
|
||||
@@ -0,0 +1,363 @@
|
||||
using Microsoft.EntityFrameworkCore;
|
||||
using ZB.MOM.WW.OtOpcUa.AdminUI.Uns;
|
||||
using ZB.MOM.WW.OtOpcUa.Configuration;
|
||||
using ZB.MOM.WW.OtOpcUa.Configuration.Enums;
|
||||
using ZB.MOM.WW.OtOpcUa.Core.Authorization;
|
||||
|
||||
namespace ZB.MOM.WW.OtOpcUa.AdminUI.Acls;
|
||||
|
||||
/// <summary>EF-backed <see cref="IAclScopeService"/>.</summary>
|
||||
/// <remarks>
|
||||
/// The two trees are projected from the services that already own them —
|
||||
/// <see cref="IRawTreeService"/> for the raw side (keeping its lazy expansion) and
|
||||
/// <see cref="IUnsTreeService"/> for the UNS side (which loads whole) — so the picker cannot show a
|
||||
/// hierarchy that disagrees with <c>/raw</c> or <c>/uns</c>. Only <see cref="CheckScopeAsync"/> and the
|
||||
/// principal lookups go to the database directly.
|
||||
/// </remarks>
|
||||
public sealed class AclScopeService : IAclScopeService
|
||||
{
|
||||
private readonly IDbContextFactory<OtOpcUaConfigDbContext> _dbFactory;
|
||||
private readonly IRawTreeService _raw;
|
||||
private readonly IUnsTreeService _uns;
|
||||
private readonly TimeProvider _time;
|
||||
|
||||
/// <summary>Initializes a new instance of the <see cref="AclScopeService"/> class.</summary>
|
||||
/// <param name="dbFactory">The config DB context factory.</param>
|
||||
/// <param name="raw">The raw project-tree service.</param>
|
||||
/// <param name="uns">The UNS tree service.</param>
|
||||
/// <param name="time">Clock used to decide whether a key has already expired.</param>
|
||||
public AclScopeService(
|
||||
IDbContextFactory<OtOpcUaConfigDbContext> dbFactory,
|
||||
IRawTreeService raw,
|
||||
IUnsTreeService uns,
|
||||
TimeProvider? time = null)
|
||||
{
|
||||
_dbFactory = dbFactory;
|
||||
_raw = raw;
|
||||
_uns = uns;
|
||||
_time = time ?? TimeProvider.System;
|
||||
}
|
||||
|
||||
/// <inheritdoc />
|
||||
public async Task<AclScopeRoots> LoadRootsAsync(string clusterId, CancellationToken ct = default)
|
||||
{
|
||||
ArgumentException.ThrowIfNullOrWhiteSpace(clusterId);
|
||||
|
||||
// Both services root their trees at Enterprise → Cluster, but searching the roots as well as their
|
||||
// children keeps this working if a cluster ever surfaces at the top level.
|
||||
var rawRoots = await _raw.LoadRootsAsync(ct).ConfigureAwait(false);
|
||||
var rawCluster = rawRoots
|
||||
.Concat(rawRoots.SelectMany(r => r.Children))
|
||||
.FirstOrDefault(n => n.Kind == RawNodeKind.Cluster
|
||||
&& string.Equals(n.EntityId, clusterId, StringComparison.Ordinal));
|
||||
|
||||
var unsRoots = await _uns.LoadStructureAsync(ct).ConfigureAwait(false);
|
||||
var unsCluster = unsRoots
|
||||
.Concat(unsRoots.SelectMany(r => r.Children))
|
||||
.FirstOrDefault(n => n.Kind == UnsNodeKind.Cluster
|
||||
&& string.Equals(n.EntityId, clusterId, StringComparison.Ordinal));
|
||||
|
||||
var raw = rawCluster is null
|
||||
? Array.Empty<AclScopeNode>()
|
||||
: new[] { ProjectRaw(rawCluster, parentPath: null) };
|
||||
|
||||
var uns = unsCluster is null
|
||||
? Array.Empty<AclScopeNode>()
|
||||
: ProjectUnsChildren(unsCluster, parentPath: null);
|
||||
|
||||
return new AclScopeRoots(raw, uns);
|
||||
}
|
||||
|
||||
/// <inheritdoc />
|
||||
public async Task<IReadOnlyList<AclScopeNode>> LoadChildrenAsync(
|
||||
AclScopeNode parent, CancellationToken ct = default)
|
||||
{
|
||||
ArgumentNullException.ThrowIfNull(parent);
|
||||
if (parent.RawSource is null) return Array.Empty<AclScopeNode>();
|
||||
|
||||
var children = await _raw.LoadChildrenAsync(parent.RawSource, ct).ConfigureAwait(false);
|
||||
return children.Select(c => ProjectRaw(c, parent.PathLabel)).ToList();
|
||||
}
|
||||
|
||||
/// <inheritdoc />
|
||||
public async Task<AclScopeCheck> CheckScopeAsync(
|
||||
string clusterId, NodeAclScopeKind kind, string? scopeId, CancellationToken ct = default)
|
||||
{
|
||||
ArgumentException.ThrowIfNullOrWhiteSpace(clusterId);
|
||||
|
||||
// Mirrors DraftValidator.ValidateNodeAclScopes, in its order, so the page and the deploy gate
|
||||
// cannot disagree about which rows are authorable. The messages are shorter because the operator
|
||||
// is looking at the field; the rules are the same.
|
||||
if (!Enum.IsDefined(kind))
|
||||
return new AclScopeCheck(false,
|
||||
$"Scope kind ordinal {(int)kind} is not a defined kind — re-pick the scope.");
|
||||
|
||||
if (kind == NodeAclScopeKind.Cluster)
|
||||
return string.IsNullOrWhiteSpace(scopeId)
|
||||
? new AclScopeCheck(true, $"The whole of cluster '{clusterId}', in both namespaces.")
|
||||
: new AclScopeCheck(false,
|
||||
"A Cluster grant covers the whole cluster and ignores the scope target — clear the " +
|
||||
"target, or pick the level the id names. Leaving both would grant more than intended.");
|
||||
|
||||
if (kind == NodeAclScopeKind.FolderSegment)
|
||||
return new AclScopeCheck(false,
|
||||
"FolderSegment is a retired v2 kind with no v3 entity behind it; it can never resolve, " +
|
||||
"whatever its target. Re-scope to RawFolder.");
|
||||
|
||||
if (string.IsNullOrWhiteSpace(scopeId))
|
||||
return new AclScopeCheck(false,
|
||||
$"{kind} needs a scope target. Only a Cluster grant may omit one; without it the grant " +
|
||||
"resolves to no node and is dropped when the configuration is built.");
|
||||
|
||||
var id = scopeId.Trim();
|
||||
|
||||
if (kind == NodeAclScopeKind.Namespace)
|
||||
{
|
||||
var realm = NodeAclRealms.TryCanonicalize(id);
|
||||
return realm is null
|
||||
? new AclScopeCheck(false,
|
||||
$"'{id}' names no OPC UA namespace. Use '{NodeAclRealms.Raw}' or '{NodeAclRealms.Uns}'.")
|
||||
: new AclScopeCheck(true,
|
||||
realm == NodeAclRealms.Raw
|
||||
? $"Every raw node in cluster '{clusterId}'."
|
||||
: $"Every UNS node in cluster '{clusterId}'.");
|
||||
}
|
||||
|
||||
await using var db = await _dbFactory.CreateDbContextAsync(ct).ConfigureAwait(false);
|
||||
|
||||
// Each arm names the entity type the kind's ScopeId is drawn from, and walks to the cluster that
|
||||
// owns it. Switch arms evaluate lazily, so only the matched kind's query runs. No AsNoTracking:
|
||||
// every arm projects into Found, and EF tracks nothing it does not materialise as an entity.
|
||||
var (entity, owner, name) = kind switch
|
||||
{
|
||||
NodeAclScopeKind.RawFolder => await ResolveAsync(
|
||||
"raw folder",
|
||||
db.RawFolders.Where(f => f.RawFolderId == id).Select(f => new Found(f.ClusterId, f.Name)),
|
||||
ct).ConfigureAwait(false),
|
||||
|
||||
NodeAclScopeKind.RawDriver => await ResolveAsync(
|
||||
"driver",
|
||||
db.DriverInstances.Where(d => d.DriverInstanceId == id).Select(d => new Found(d.ClusterId, d.Name)),
|
||||
ct).ConfigureAwait(false),
|
||||
|
||||
NodeAclScopeKind.RawDevice => await ResolveAsync(
|
||||
"device",
|
||||
from d in db.Devices
|
||||
where d.DeviceId == id
|
||||
join dr in db.DriverInstances on d.DriverInstanceId equals dr.DriverInstanceId
|
||||
select new Found(dr.ClusterId, d.Name),
|
||||
ct).ConfigureAwait(false),
|
||||
|
||||
NodeAclScopeKind.RawTagGroup => await ResolveAsync(
|
||||
"tag group",
|
||||
from g in db.TagGroups
|
||||
where g.TagGroupId == id
|
||||
join dev in db.Devices on g.DeviceId equals dev.DeviceId
|
||||
join dr in db.DriverInstances on dev.DriverInstanceId equals dr.DriverInstanceId
|
||||
select new Found(dr.ClusterId, g.Name),
|
||||
ct).ConfigureAwait(false),
|
||||
|
||||
NodeAclScopeKind.Tag => await ResolveAsync(
|
||||
"raw tag",
|
||||
from t in db.Tags
|
||||
where t.TagId == id
|
||||
join dev in db.Devices on t.DeviceId equals dev.DeviceId
|
||||
join dr in db.DriverInstances on dev.DriverInstanceId equals dr.DriverInstanceId
|
||||
select new Found(dr.ClusterId, t.Name),
|
||||
ct).ConfigureAwait(false),
|
||||
|
||||
NodeAclScopeKind.UnsArea => await ResolveAsync(
|
||||
"UNS area",
|
||||
db.UnsAreas.Where(a => a.UnsAreaId == id).Select(a => new Found(a.ClusterId, a.Name)),
|
||||
ct).ConfigureAwait(false),
|
||||
|
||||
NodeAclScopeKind.UnsLine => await ResolveAsync(
|
||||
"UNS line",
|
||||
from l in db.UnsLines
|
||||
where l.UnsLineId == id
|
||||
join a in db.UnsAreas on l.UnsAreaId equals a.UnsAreaId
|
||||
select new Found(a.ClusterId, l.Name),
|
||||
ct).ConfigureAwait(false),
|
||||
|
||||
NodeAclScopeKind.Equipment => await ResolveAsync(
|
||||
"equipment",
|
||||
from e in db.Equipment
|
||||
where e.EquipmentId == id
|
||||
join l in db.UnsLines on e.UnsLineId equals l.UnsLineId
|
||||
join a in db.UnsAreas on l.UnsAreaId equals a.UnsAreaId
|
||||
select new Found(a.ClusterId, e.Name),
|
||||
ct).ConfigureAwait(false),
|
||||
|
||||
// Cluster / Namespace / FolderSegment all returned above, and an undefined ordinal did too.
|
||||
_ => ("scope", null, null),
|
||||
};
|
||||
|
||||
if (owner is null)
|
||||
return new AclScopeCheck(false,
|
||||
$"No {entity} in this configuration has the id '{id}' — or its parent chain is broken, so " +
|
||||
"no cluster owns it. The grant would be dropped when the configuration is built and would " +
|
||||
"authorize nothing.");
|
||||
|
||||
if (!string.Equals(owner, clusterId, StringComparison.OrdinalIgnoreCase))
|
||||
return new AclScopeCheck(false,
|
||||
$"That {entity} belongs to cluster '{owner}', but this grant is in cluster '{clusterId}'. " +
|
||||
"The id is real, so the grant would confer authority across a cluster boundary. Author it " +
|
||||
$"under '{owner}' instead.");
|
||||
|
||||
return new AclScopeCheck(true,
|
||||
$"{char.ToUpperInvariant(entity[0])}{entity[1..]} '{name}' in cluster '{clusterId}'.");
|
||||
}
|
||||
|
||||
/// <inheritdoc />
|
||||
public async Task<IReadOnlyList<string>> LoadKnownPrincipalsAsync(CancellationToken ct = default)
|
||||
{
|
||||
await using var db = await _dbFactory.CreateDbContextAsync(ct).ConfigureAwait(false);
|
||||
|
||||
var fromKeys = await db.ApiKeys.AsNoTracking().Select(k => k.Principal).Distinct()
|
||||
.ToListAsync(ct).ConfigureAwait(false);
|
||||
var fromAcls = await db.NodeAcls.AsNoTracking().Select(a => a.Principal).Distinct()
|
||||
.ToListAsync(ct).ConfigureAwait(false);
|
||||
|
||||
return fromKeys
|
||||
.Concat(fromAcls)
|
||||
.Append(OpcUaPrincipals.Anonymous)
|
||||
.Where(p => !string.IsNullOrWhiteSpace(p))
|
||||
.Select(p => p.Trim())
|
||||
.Distinct(StringComparer.OrdinalIgnoreCase)
|
||||
.OrderBy(p => p, StringComparer.OrdinalIgnoreCase)
|
||||
.ToList();
|
||||
}
|
||||
|
||||
/// <inheritdoc />
|
||||
public async Task<PrincipalUsage> CheckPrincipalAsync(string principal, CancellationToken ct = default)
|
||||
{
|
||||
if (string.IsNullOrWhiteSpace(principal)) return new PrincipalUsage(false, 0, 0);
|
||||
|
||||
var name = principal.Trim();
|
||||
if (string.Equals(name, OpcUaPrincipals.Anonymous, StringComparison.OrdinalIgnoreCase))
|
||||
return new PrincipalUsage(true, 0, 0);
|
||||
|
||||
await using var db = await _dbFactory.CreateDbContextAsync(ct).ConfigureAwait(false);
|
||||
|
||||
var keys = await db.ApiKeys.AsNoTracking()
|
||||
.Where(k => k.Principal == name)
|
||||
.Select(k => new { k.Enabled, k.ExpiresUtc })
|
||||
.ToListAsync(ct).ConfigureAwait(false);
|
||||
|
||||
var now = _time.GetUtcNow().UtcDateTime;
|
||||
var live = keys.Count(k => k.Enabled && (k.ExpiresUtc is null || k.ExpiresUtc > now));
|
||||
return new PrincipalUsage(false, live, keys.Count - live);
|
||||
}
|
||||
|
||||
// --- Projection --------------------------------------------------------------------------------
|
||||
|
||||
private static AclScopeNode ProjectRaw(RawNode node, string? parentPath)
|
||||
{
|
||||
var kind = RawScopeKind(node.Kind);
|
||||
var path = Join(parentPath, node.DisplayName);
|
||||
|
||||
var projected = new AclScopeNode
|
||||
{
|
||||
Key = node.Key,
|
||||
DisplayName = node.DisplayName,
|
||||
Icon = RawIcon(node.Kind),
|
||||
ScopeKind = kind,
|
||||
// A Cluster grant covers its whole cluster and carries no id — the deploy gate rejects one
|
||||
// that does, so the picker must not produce one.
|
||||
ScopeId = kind == NodeAclScopeKind.Cluster ? null : node.EntityId,
|
||||
PathLabel = path,
|
||||
HasLazyChildren = node.HasLazyChildren,
|
||||
RawSource = node,
|
||||
};
|
||||
|
||||
foreach (var child in node.Children) projected.Children.Add(ProjectRaw(child, path));
|
||||
return projected;
|
||||
}
|
||||
|
||||
private static IReadOnlyList<AclScopeNode> ProjectUnsChildren(UnsNode cluster, string? parentPath) =>
|
||||
cluster.Children.Select(c => ProjectUns(c, parentPath)).ToList();
|
||||
|
||||
private static AclScopeNode ProjectUns(UnsNode node, string? parentPath)
|
||||
{
|
||||
var path = Join(parentPath, node.DisplayName);
|
||||
|
||||
var projected = new AclScopeNode
|
||||
{
|
||||
Key = node.Key,
|
||||
DisplayName = node.DisplayName,
|
||||
Icon = UnsIcon(node.Kind),
|
||||
ScopeKind = UnsScopeKind(node.Kind),
|
||||
ScopeId = node.EntityId,
|
||||
PathLabel = path,
|
||||
HasLazyChildren = false,
|
||||
// Everything below the cluster is already materialised — nothing to expand lazily, and no raw
|
||||
// node to expand it from.
|
||||
RawSource = null,
|
||||
Expanded = true,
|
||||
};
|
||||
|
||||
foreach (var child in node.Children) projected.Children.Add(ProjectUns(child, path));
|
||||
return projected;
|
||||
}
|
||||
|
||||
private static string Join(string? parent, string name) =>
|
||||
string.IsNullOrEmpty(parent) ? name : $"{parent} / {name}";
|
||||
|
||||
private static NodeAclScopeKind? RawScopeKind(RawNodeKind kind) => kind switch
|
||||
{
|
||||
RawNodeKind.Cluster => NodeAclScopeKind.Cluster,
|
||||
RawNodeKind.Folder => NodeAclScopeKind.RawFolder,
|
||||
RawNodeKind.Driver => NodeAclScopeKind.RawDriver,
|
||||
RawNodeKind.Device => NodeAclScopeKind.RawDevice,
|
||||
RawNodeKind.TagGroup => NodeAclScopeKind.RawTagGroup,
|
||||
RawNodeKind.Tag => NodeAclScopeKind.Tag,
|
||||
_ => null, // Enterprise: a label, not a scope.
|
||||
};
|
||||
|
||||
// Area/Line/Equipment only. A UNS tag row is a UnsTagReference, not a Tag — its scope is the RAW tag it
|
||||
// points at, and a Tag grant already covers the raw node AND every UNS projection of it (see
|
||||
// AclScopePathResolver). Offering a UNS tag here would produce a grant that reads as narrower than the
|
||||
// one it actually creates.
|
||||
private static NodeAclScopeKind? UnsScopeKind(UnsNodeKind kind) => kind switch
|
||||
{
|
||||
UnsNodeKind.Area => NodeAclScopeKind.UnsArea,
|
||||
UnsNodeKind.Line => NodeAclScopeKind.UnsLine,
|
||||
UnsNodeKind.Equipment => NodeAclScopeKind.Equipment,
|
||||
_ => null,
|
||||
};
|
||||
|
||||
private static string RawIcon(RawNodeKind kind) => kind switch
|
||||
{
|
||||
RawNodeKind.Enterprise => "🏢",
|
||||
RawNodeKind.Cluster => "🖥️",
|
||||
RawNodeKind.Folder => "📁",
|
||||
RawNodeKind.Driver => "🔌",
|
||||
RawNodeKind.Device => "📟",
|
||||
RawNodeKind.TagGroup => "🗂️",
|
||||
RawNodeKind.Tag => "🏷️",
|
||||
_ => "•",
|
||||
};
|
||||
|
||||
private static string UnsIcon(UnsNodeKind kind) => kind switch
|
||||
{
|
||||
UnsNodeKind.Area => "🗺️",
|
||||
UnsNodeKind.Line => "🏭",
|
||||
UnsNodeKind.Equipment => "⚙️",
|
||||
_ => "•",
|
||||
};
|
||||
|
||||
// --- Resolution helpers ------------------------------------------------------------------------
|
||||
|
||||
// A class, not a struct: FirstOrDefaultAsync over a struct yields default(T), which is indistinguishable
|
||||
// from a real row whose fields happen to be empty — a null reference cannot be misread that way.
|
||||
private sealed record Found(string ClusterId, string Name);
|
||||
|
||||
private static async Task<(string Entity, string? Owner, string? Name)> ResolveAsync(
|
||||
string entity, IQueryable<Found> query, CancellationToken ct)
|
||||
{
|
||||
// FirstOrDefault, not Single: a duplicated id is a different rule's business, and throwing here
|
||||
// would replace a precise message with an exception page.
|
||||
var hit = await query.FirstOrDefaultAsync(ct).ConfigureAwait(false);
|
||||
return hit is null ? (entity, null, null) : (entity, hit.ClusterId, hit.Name);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,72 @@
|
||||
using ZB.MOM.WW.OtOpcUa.Configuration.Enums;
|
||||
|
||||
namespace ZB.MOM.WW.OtOpcUa.AdminUI.Acls;
|
||||
|
||||
/// <summary>
|
||||
/// Backs the ACL authoring surface (#520 stage 7): the scope picker's two trees, and the
|
||||
/// authoring-time checks that stop a grant being saved against a principal or a scope that names
|
||||
/// nothing.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// <para>
|
||||
/// <b>A service rather than logic in the Razor pages, because this repo has no bUnit</b> — anything
|
||||
/// only a page can reach is untestable, and the whole point of the stage is that authoring stops
|
||||
/// producing grants that silently authorize nobody. The same rationale
|
||||
/// <c>IApiKeyAdminService</c> carries.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// <b>The picker chooses the kind and the id together.</b> Before this, <c>ScopeKind</c> was a
|
||||
/// dropdown and <c>ScopeId</c> a free-text box, so the two could disagree — a
|
||||
/// <see cref="NodeAclScopeKind.RawDevice"/> row pointing at a TagId is well-formed, saves, deploys,
|
||||
/// and resolves to nothing. Selecting a tree node produces both, so that pairing cannot be made by
|
||||
/// hand. <see cref="CheckScopeAsync"/> is what catches the rows that already exist, or that were
|
||||
/// typed in before the picker was reached.
|
||||
/// </para>
|
||||
/// </remarks>
|
||||
public interface IAclScopeService
|
||||
{
|
||||
/// <summary>
|
||||
/// Loads the raw and UNS scope trees for one cluster. Both are rooted at that cluster, so a scope in
|
||||
/// another cluster is unreachable through the picker rather than merely discouraged — the structural
|
||||
/// equivalent of the deploy gate's <c>NodeAclScopeCrossCluster</c> rule.
|
||||
/// </summary>
|
||||
/// <param name="clusterId">The cluster the grant belongs to.</param>
|
||||
/// <param name="ct">The cancellation token.</param>
|
||||
/// <returns>The two trees; either may be empty when the cluster has nothing of that kind yet.</returns>
|
||||
Task<AclScopeRoots> LoadRootsAsync(string clusterId, CancellationToken ct = default);
|
||||
|
||||
/// <summary>
|
||||
/// Loads one lazy level beneath a raw-tree node. UNS nodes are loaded whole by
|
||||
/// <see cref="LoadRootsAsync"/> and never reach here.
|
||||
/// </summary>
|
||||
/// <param name="parent">The node being expanded.</param>
|
||||
/// <param name="ct">The cancellation token.</param>
|
||||
/// <returns>The child rows, or empty for a leaf.</returns>
|
||||
Task<IReadOnlyList<AclScopeNode>> LoadChildrenAsync(AclScopeNode parent, CancellationToken ct = default);
|
||||
|
||||
/// <summary>
|
||||
/// Resolves an authored scope against the current configuration, mirroring the deploy gate's
|
||||
/// <c>NodeAclScope*</c> rules so the page rejects what the deployment would reject.
|
||||
/// </summary>
|
||||
/// <param name="clusterId">The cluster the grant belongs to.</param>
|
||||
/// <param name="kind">The authored scope kind.</param>
|
||||
/// <param name="scopeId">The authored scope id; null or blank for a cluster-wide grant.</param>
|
||||
/// <param name="ct">The cancellation token.</param>
|
||||
/// <returns>What the scope resolves to, or why it does not.</returns>
|
||||
Task<AclScopeCheck> CheckScopeAsync(
|
||||
string clusterId, NodeAclScopeKind kind, string? scopeId, CancellationToken ct = default);
|
||||
|
||||
/// <summary>
|
||||
/// Lists the principal names worth suggesting: every principal an API key authenticates as, every
|
||||
/// principal an existing grant already names, and the reserved <c>anonymous</c> principal.
|
||||
/// </summary>
|
||||
/// <param name="ct">The cancellation token.</param>
|
||||
/// <returns>Distinct principal names, ordered.</returns>
|
||||
Task<IReadOnlyList<string>> LoadKnownPrincipalsAsync(CancellationToken ct = default);
|
||||
|
||||
/// <summary>Reports how many API keys currently authenticate as a principal.</summary>
|
||||
/// <param name="principal">The principal name as authored.</param>
|
||||
/// <param name="ct">The cancellation token.</param>
|
||||
/// <returns>The usage counts.</returns>
|
||||
Task<PrincipalUsage> CheckPrincipalAsync(string principal, CancellationToken ct = default);
|
||||
}
|
||||
Reference in New Issue
Block a user