Joseph Doherty
4d376f727f
Stage 1a of the API-key ACL design. Behaviour-neutral: the trie walker already matched an opaque string, so only what produces that string changes. No enforcement is wired by this commit and none of the two live role gates move. Renamed through the ACL model: NodeAcl.Principal, TrieGrant.Principal, MatchedGrant.Principal, AuthorizationDecision.Principal, UserAuthorizationState.Principals, and PermissionTrie.CollectMatches's parameter. LdapGroupRoleMapping is a DIFFERENT entity that also has an LdapGroup column and is deliberately untouched — it backs AdminUI login, which keeps LDAP. The migration is the interesting part. EF scaffolds RenameColumn/RenameIndex, so rows survive — but it cannot know that dbo.sp_ComputeGenerationDiff checksums NodeAcl.LdapGroup. That proc is created in V3Initial.StoredProcedures and never redefined since, and SQL Server does not validate a procedure body when a column is renamed out from under it: the object keeps reporting healthy and fails at CALL time with Invalid column name, silently breaking config-drift detection. Verified against the live dev DB that the deployed proc really does reference the column. The migration therefore re-emits the proc, as one parameterised template shared by Up and Down so the two cannot drift. Prose that describes what is enforced TODAY (fleet-wide LDAP group -> role) is left alone, because it is still accurate until stage 2 lands. UserAuthorizationState's refresh machinery is retained unchanged but now carries a note that it is LDAP-shaped and largely vestigial here: an API-key principal set cannot change out of band, since keys and ACL rows both ride the deployment artifact, so the generation stamp rather than the freshness timer is the real invalidation signal. 41 authorization tests pass; solution builds clean. Claude-Session: https://claude.ai/code/session_015p7wGqy3YpZNCpDzTpGMKo
38 lines
1.7 KiB
C#
38 lines
1.7 KiB
C#
using ZB.MOM.WW.OtOpcUa.Configuration.Enums;
|
|
|
|
namespace ZB.MOM.WW.OtOpcUa.Configuration.Entities;
|
|
|
|
/// <summary>
|
|
/// One ACL grant: a principal gets a set of <see cref="NodePermissions"/> at a specific scope.
|
|
/// Generation-versioned per decision. See <c>acl-design.md</c> for evaluation algorithm.
|
|
/// </summary>
|
|
public sealed class NodeAcl
|
|
{
|
|
/// <summary>Gets or sets the database row ID for this ACL entry.</summary>
|
|
public Guid NodeAclRowId { get; set; }
|
|
|
|
/// <summary>Gets or sets the logical ID of this ACL entry.</summary>
|
|
public required string NodeAclId { get; set; }
|
|
|
|
/// <summary>Gets or sets the cluster ID for this ACL entry.</summary>
|
|
public required string ClusterId { get; set; }
|
|
|
|
/// <summary>Gets or sets the principal (API-key principal name, or the reserved <c>anonymous</c>) this ACL entry grants to.</summary>
|
|
public required string Principal { get; set; }
|
|
|
|
/// <summary>Gets or sets the scope kind for this ACL entry.</summary>
|
|
public required NodeAclScopeKind ScopeKind { get; set; }
|
|
|
|
/// <summary>NULL when <see cref="ScopeKind"/> = <see cref="NodeAclScopeKind.Cluster"/>; otherwise the scoped entity's logical ID.</summary>
|
|
public string? ScopeId { get; set; }
|
|
|
|
/// <summary>Bitmask of <see cref="NodePermissions"/>. Stored as int in SQL.</summary>
|
|
public required NodePermissions PermissionFlags { get; set; }
|
|
|
|
/// <summary>Gets or sets optional notes for this ACL entry.</summary>
|
|
public string? Notes { get; set; }
|
|
|
|
/// <summary>Optimistic concurrency token for last-write-wins detection in the v2 live-edit model.</summary>
|
|
public byte[] RowVersion { get; set; } = Array.Empty<byte>();
|
|
}
|