lmxopcua/tests/Server/ZB.MOM.WW.OtOpcUa.Host.Tests/OpcUa/ArtifactApiKeyStoreTests.cs

using Shouldly;
using Xunit;
using ZB.MOM.WW.OtOpcUa.Configuration.Entities;
using ZB.MOM.WW.OtOpcUa.Configuration.Enums;
using ZB.MOM.WW.OtOpcUa.Core.Authorization;
using ZB.MOM.WW.OtOpcUa.Host.OpcUa;

namespace ZB.MOM.WW.OtOpcUa.Host.Tests.OpcUa;

/// <summary>
///     The key source for a driver-only node (#520 stage 4) — the one with no ConfigDb, which until this
///     stage denied every UserName token.
/// </summary>
public sealed class ArtifactApiKeyStoreTests
{
    private static readonly DateTime Now = new(2026, 7, 31, 12, 0, 0, DateTimeKind.Utc);

    /// <summary>
    ///     No test here exercises a narrower-than-Cluster scope, so the resolved scope paths are empty.
    /// </summary>
    private static readonly IReadOnlyDictionary<AclScopeRef, IReadOnlyList<NodeAclPath>> NoScopePaths =
        new Dictionary<AclScopeRef, IReadOnlyList<NodeAclPath>>();

    [Fact]
    public async Task A_node_that_has_not_been_deployed_to_authenticates_nothing()
    {
        var sut = new ArtifactApiKeyStore(new DataPlaneAuthorityState());

        (await sut.FindAsync("abc", Now, default)).ShouldBeNull();
    }

    [Fact]
    public async Task A_deployed_key_resolves_with_its_principals_cluster_grants()
    {
        var state = new DataPlaneAuthorityState();
        state.Apply("cluster-a", "rev-1",
            [Key("abc", "scadabridge-dcl")],
            [Acl("acl-1", "scadabridge-dcl", NodeAclScopeKind.Cluster, NodePermissions.WriteOperate)], NoScopePaths);

        var found = await new ArtifactApiKeyStore(state).FindAsync("abc", Now, default);

        found.ShouldNotBeNull();
        found!.Key.Principal.ShouldBe("scadabridge-dcl");
        found.Grants.ShouldHaveSingleItem().PermissionFlags.ShouldBe(NodePermissions.WriteOperate);
    }

    [Fact]
    public async Task Only_cluster_scoped_grants_are_returned()
    {
        // Narrower scopes are not yet enforceable (stage 5), and ApiKeyInterimRoleMapper deliberately
        // under-grants rather than promoting a scoped grant's flags to server-wide authority. Scope kind
        // is the only narrowing this store performs — cluster confinement already happened in
        // ParseDataPlaneAuthority, which is where it differs from ConfigDbApiKeyStore (that one filters
        // on cluster itself; see ConfigDbApiKeyStoreTests).
        var state = new DataPlaneAuthorityState();
        state.Apply("cluster-a", "rev-1",
            [Key("abc", "p")],
            [
                Acl("acl-cluster", "p", NodeAclScopeKind.Cluster, NodePermissions.Read),
                Acl("acl-equipment", "p", NodeAclScopeKind.Equipment, NodePermissions.WriteOperate),
            ], NoScopePaths);

        var found = await new ArtifactApiKeyStore(state).FindAsync("abc", Now, default);

        found!.Grants.ShouldHaveSingleItem().NodeAclId.ShouldBe("acl-cluster");
    }

    [Fact]
    public async Task A_revoked_key_is_denied_once_the_revoking_artifact_arrives()
    {
        // The whole revocation story for a driver-only node: it takes effect on the next deployment, and
        // this is that deployment landing.
        var state = new DataPlaneAuthorityState();
        var sut = new ArtifactApiKeyStore(state);

        state.Apply("cluster-a", "rev-1", [Key("abc", "p")], [], NoScopePaths);
        (await sut.FindAsync("abc", Now, default)).ShouldNotBeNull();

        var revoked = Key("abc", "p");
        revoked.Enabled = false;
        state.Apply("cluster-a", "rev-2", [revoked], [], NoScopePaths);

        (await sut.FindAsync("abc", Now, default)).ShouldBeNull();
    }

    [Fact]
    public async Task Anonymous_grants_resolve_without_a_key()
    {
        // The anonymous principal has grants but obviously no credential, so FindGrantsAsync is its path.
        var state = new DataPlaneAuthorityState();
        state.Apply("cluster-a", "rev-1", [],
            [Acl("acl-anon", OpcUaPrincipals.Anonymous, NodeAclScopeKind.Cluster, NodePermissions.Read)],
            NoScopePaths);

        var grants = await new ArtifactApiKeyStore(state).FindGrantsAsync(OpcUaPrincipals.Anonymous, default);

        grants.ShouldHaveSingleItem().PermissionFlags.ShouldBe(NodePermissions.Read);
    }

    private static ApiKey Key(string id, string principal) => new()
    {
        ApiKeyId = id,
        Name = id,
        SecretHash = "hash",
        Principal = principal,
        Enabled = true,
        CreatedUtc = Now.AddDays(-1),
    };

    private static NodeAcl Acl(string id, string principal, NodeAclScopeKind scope, NodePermissions flags) => new()
    {
        NodeAclId = id,
        ClusterId = "cluster-a",
        Principal = principal,
        ScopeKind = scope,
        PermissionFlags = flags,
    };
}