Joseph Doherty
45 lines
2.5 KiB
C#
45 lines
2.5 KiB
C#
using ZB.MOM.WW.OtOpcUa.Configuration.Entities;
|
|
using ZB.MOM.WW.OtOpcUa.Configuration.Services;
|
|
|
|
namespace ZB.MOM.WW.OtOpcUa.Security.Ldap;
|
|
|
|
/// <summary>
|
|
/// Driver-only-node stand-in for the EF-backed <see cref="ILdapGroupRoleMappingService"/>.
|
|
/// A driver-only node (Akka role <c>driver</c>, not <c>admin</c>) has no ConfigDb connection
|
|
/// (Phase 4 gated <c>AddOtOpcUaConfigDb</c> on <c>hasAdmin</c>), so it can never read the
|
|
/// control-plane <c>LdapGroupRoleMapping</c> DB grants that <see cref="OtOpcUaGroupRoleMapper"/>
|
|
/// normally unions into its result. This implementation always reports "no DB grants" so the
|
|
/// data-path mapper falls back to exactly the appsettings <c>Security:Ldap:GroupToRole</c>
|
|
/// baseline — the same safe fallback the mapper already takes when the real service simply
|
|
/// has no matching rows. <see cref="LdapGroupRoleMapping"/> rows are not composed into the
|
|
/// deployment artifact either, so a driver node never had DB grants via config; reporting
|
|
/// empty here is honest, not lossy.
|
|
/// </summary>
|
|
/// <remarks>
|
|
/// The write surface (<see cref="CreateAsync"/>/<see cref="DeleteAsync"/>) is control-plane-only
|
|
/// Admin UI functionality that a driver-only node — which has no Admin UI — never calls. It
|
|
/// throws rather than silently no-opping so an accidental call surfaces immediately instead of
|
|
/// pretending to persist a grant that a driver-only node cannot store.
|
|
/// </remarks>
|
|
public sealed class NullLdapGroupRoleMappingService : ILdapGroupRoleMappingService
|
|
{
|
|
/// <inheritdoc />
|
|
public Task<IReadOnlyList<LdapGroupRoleMapping>> GetByGroupsAsync(
|
|
IEnumerable<string> ldapGroups, CancellationToken cancellationToken)
|
|
=> Task.FromResult<IReadOnlyList<LdapGroupRoleMapping>>(Array.Empty<LdapGroupRoleMapping>());
|
|
|
|
/// <inheritdoc />
|
|
public Task<IReadOnlyList<LdapGroupRoleMapping>> ListAllAsync(CancellationToken cancellationToken)
|
|
=> Task.FromResult<IReadOnlyList<LdapGroupRoleMapping>>(Array.Empty<LdapGroupRoleMapping>());
|
|
|
|
/// <inheritdoc />
|
|
public Task<LdapGroupRoleMapping> CreateAsync(LdapGroupRoleMapping row, CancellationToken cancellationToken)
|
|
=> throw new NotSupportedException(
|
|
"LDAP group-role grants are control-plane only; a driver-only node has no ConfigDb.");
|
|
|
|
/// <inheritdoc />
|
|
public Task DeleteAsync(Guid id, CancellationToken cancellationToken)
|
|
=> throw new NotSupportedException(
|
|
"LDAP group-role grants are control-plane only; a driver-only node has no ConfigDb.");
|
|
}
|