0fcdfc7546
Stream A.1-A.2 per docs/v2/implementation/phase-6-2-authorization-runtime.md.
Seed-data migration (A.3) is a separate follow-up once production LDAP group
DNs are finalised; until then CRUD via the Admin UI handles the fleet set up.
Configuration:
- New AdminRole enum {ConfigViewer, ConfigEditor, FleetAdmin} — string-stored.
- New LdapGroupRoleMapping entity with Id (surrogate PK), LdapGroup (512 chars),
Role (AdminRole enum), ClusterId (nullable, FK to ServerCluster), IsSystemWide,
CreatedAtUtc, Notes.
- EF config: UX_LdapGroupRoleMapping_Group_Cluster unique index on
(LdapGroup, ClusterId) + IX_LdapGroupRoleMapping_Group hot-path index on
LdapGroup for sign-in lookups. Cluster FK cascades on cluster delete.
- Migration 20260419_..._AddLdapGroupRoleMapping generated via `dotnet ef`.
Configuration.Services:
- ILdapGroupRoleMappingService — CRUD surface. Declared as control-plane only
per decision #150; the OPC UA data-path evaluator must NOT depend on this
interface (Phase 6.2 compliance check on control/data-plane separation).
GetByGroupsAsync is the hot-path sign-in lookup.
- LdapGroupRoleMappingService (EF Core impl) enforces the write-time invariant
"exactly one of (ClusterId populated, IsSystemWide=true)" and surfaces
InvalidLdapGroupRoleMappingException on violation. Create auto-populates Id
+ CreatedAtUtc when omitted.
Tests (9 new, all pass) in Configuration.Tests:
- Create sets Id + CreatedAtUtc.
- Create rejects empty LdapGroup.
- Create rejects IsSystemWide=true with populated ClusterId.
- Create rejects IsSystemWide=false with null ClusterId.
- GetByGroupsAsync returns matching rows only.
- GetByGroupsAsync with empty input returns empty (no full-table scan).
- ListAllAsync orders by group then cluster.
- Delete removes the target row.
- Delete of unknown id is a no-op.
Microsoft.EntityFrameworkCore.InMemory 10.0.0 added to Configuration.Tests for
the service-level tests (schema-compliance tests still use the live SQL
fixture).
SchemaComplianceTests updated to expect the new LdapGroupRoleMapping table.
Full solution dotnet test: 1051 passing (baseline 906, Phase 6.1 shipped at
1042, Phase 6.2 Stream A adds 9 = 1051). Pre-existing Client.CLI Subscribe
flake unchanged.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
70 lines
2.9 KiB
C#
70 lines
2.9 KiB
C#
using Microsoft.EntityFrameworkCore;
|
|
using ZB.MOM.WW.OtOpcUa.Configuration.Entities;
|
|
|
|
namespace ZB.MOM.WW.OtOpcUa.Configuration.Services;
|
|
|
|
/// <summary>
|
|
/// EF Core implementation of <see cref="ILdapGroupRoleMappingService"/>. Enforces the
|
|
/// "exactly one of (ClusterId, IsSystemWide)" invariant at the write surface so a
|
|
/// malformed row can't land in the DB.
|
|
/// </summary>
|
|
public sealed class LdapGroupRoleMappingService(OtOpcUaConfigDbContext db) : ILdapGroupRoleMappingService
|
|
{
|
|
public async Task<IReadOnlyList<LdapGroupRoleMapping>> GetByGroupsAsync(
|
|
IEnumerable<string> ldapGroups, CancellationToken cancellationToken)
|
|
{
|
|
ArgumentNullException.ThrowIfNull(ldapGroups);
|
|
var groupSet = ldapGroups.ToList();
|
|
if (groupSet.Count == 0) return [];
|
|
|
|
return await db.LdapGroupRoleMappings
|
|
.AsNoTracking()
|
|
.Where(m => groupSet.Contains(m.LdapGroup))
|
|
.ToListAsync(cancellationToken)
|
|
.ConfigureAwait(false);
|
|
}
|
|
|
|
public async Task<IReadOnlyList<LdapGroupRoleMapping>> ListAllAsync(CancellationToken cancellationToken)
|
|
=> await db.LdapGroupRoleMappings
|
|
.AsNoTracking()
|
|
.OrderBy(m => m.LdapGroup)
|
|
.ThenBy(m => m.ClusterId)
|
|
.ToListAsync(cancellationToken)
|
|
.ConfigureAwait(false);
|
|
|
|
public async Task<LdapGroupRoleMapping> CreateAsync(LdapGroupRoleMapping row, CancellationToken cancellationToken)
|
|
{
|
|
ArgumentNullException.ThrowIfNull(row);
|
|
ValidateInvariants(row);
|
|
|
|
if (row.Id == Guid.Empty) row.Id = Guid.NewGuid();
|
|
if (row.CreatedAtUtc == default) row.CreatedAtUtc = DateTime.UtcNow;
|
|
|
|
db.LdapGroupRoleMappings.Add(row);
|
|
await db.SaveChangesAsync(cancellationToken).ConfigureAwait(false);
|
|
return row;
|
|
}
|
|
|
|
public async Task DeleteAsync(Guid id, CancellationToken cancellationToken)
|
|
{
|
|
var existing = await db.LdapGroupRoleMappings.FindAsync([id], cancellationToken).ConfigureAwait(false);
|
|
if (existing is null) return;
|
|
db.LdapGroupRoleMappings.Remove(existing);
|
|
await db.SaveChangesAsync(cancellationToken).ConfigureAwait(false);
|
|
}
|
|
|
|
private static void ValidateInvariants(LdapGroupRoleMapping row)
|
|
{
|
|
if (string.IsNullOrWhiteSpace(row.LdapGroup))
|
|
throw new InvalidLdapGroupRoleMappingException("LdapGroup must not be empty.");
|
|
|
|
if (row.IsSystemWide && !string.IsNullOrEmpty(row.ClusterId))
|
|
throw new InvalidLdapGroupRoleMappingException(
|
|
"IsSystemWide=true requires ClusterId to be null. A fleet-wide grant cannot also be cluster-scoped.");
|
|
|
|
if (!row.IsSystemWide && string.IsNullOrEmpty(row.ClusterId))
|
|
throw new InvalidLdapGroupRoleMappingException(
|
|
"IsSystemWide=false requires a populated ClusterId. A cluster-scoped grant needs its target cluster.");
|
|
}
|
|
}
|