lmxopcua/archreview/plans/R2-05-adminui-authz-plan.md.tasks.json

{
  "planPath": "archreview/plans/R2-05-adminui-authz-plan.md",
  "lastUpdated": "2026-07-27",
  "tasks": [
    {
      "id": "T1",
      "subject": "Add AdminUiPolicies constants class (Security/Auth/AdminUiPolicies.cs)",
      "status": "completed",
      "blockedBy": []
    },
    {
      "id": "T2",
      "subject": "Policy-semantics unit test AdminUiPoliciesTests (RED: ConfigEditor/AuthenticatedRead unregistered)",
      "status": "completed",
      "blockedBy": [
        "T1"
      ]
    },
    {
      "id": "T3",
      "subject": "Reflection PageAuthorizationGuardTests (RED: must list ~35 ungated/mis-idiom pages)",
      "status": "completed",
      "blockedBy": [
        "T1"
      ]
    },
    {
      "id": "T4",
      "subject": "Register ConfigEditor + AuthenticatedRead policies; switch existing AddPolicy literals to constants (GREEN for T2)",
      "status": "completed",
      "blockedBy": [
        "T2"
      ]
    },
    {
      "id": "T5",
      "subject": "_Imports.razor usings (Authorization + Security.Auth) + de-dupe Deployments/Alerts in-file @using",
      "status": "completed",
      "blockedBy": [
        "T1"
      ]
    },
    {
      "id": "T6",
      "subject": "Gate UNS pages with ConfigEditor (GlobalUns, EquipmentPage)",
      "status": "completed",
      "blockedBy": [
        "T4",
        "T5"
      ]
    },
    {
      "id": "T7",
      "subject": "Gate cluster editors with ConfigEditor (NewCluster, ClusterEdit, NodeEdit, NamespaceEdit, AclEdit)",
      "status": "completed",
      "blockedBy": [
        "T4",
        "T5"
      ]
    },
    {
      "id": "T8",
      "subject": "Gate driver pages + routers with ConfigEditor (8 driver pages, DriverTypePicker, DriverEditRouter)",
      "status": "completed",
      "blockedBy": [
        "T4",
        "T5"
      ]
    },
    {
      "id": "T9",
      "subject": "Converge Deployments/Scripts/ScriptEdit from Roles-string to ConfigEditor policy",
      "status": "completed",
      "blockedBy": [
        "T4",
        "T5"
      ]
    },
    {
      "id": "T10",
      "subject": "Read pages to AuthenticatedRead (16 incl. Home insert) + RoleGrants to FleetAdmin constant",
      "status": "completed",
      "blockedBy": [
        "T4",
        "T5"
      ]
    },
    {
      "id": "T11",
      "subject": "Guard GREEN checkpoint + full AdminUI.Tests; commit the gate",
      "status": "completed",
      "blockedBy": [
        "T3",
        "T6",
        "T7",
        "T8",
        "T9",
        "T10"
      ]
    },
    {
      "id": "T12",
      "subject": "Converge non-page literals to constants (ScriptAnalysisEndpoints, imperative DriverOperator x4, Certificates FleetAdmin x2)",
      "status": "completed",
      "blockedBy": [
        "T11"
      ]
    },
    {
      "id": "T13",
      "subject": "Docs: CLAUDE.md ScriptAnalysis gate sentence, docs/security.md, STATUS.md R2-05 row",
      "status": "completed",
      "blockedBy": [
        "T11"
      ]
    },
    {
      "id": "T14",
      "subject": "Full-solution test sweep (dotnet test ZB.MOM.WW.OtOpcUa.slnx)",
      "status": "completed",
      "blockedBy": [
        "T12",
        "T13"
      ],
      "note": "Impacted unit suites authoritative + green: AdminUI.Tests 517/517, Security.Tests 80/80. One whole-solution sweep ran BEFORE the controller's no-whole-solution/no-IntegrationTests constraint arrived; all failures are pre-existing/env and outside the R2-05 diff (Core.Abstractions.Tests InterfaceIndependence flags pre-existing Historian.* namespace types; Runtime historian retry timing; OpcUaClient.Browser needs a live OPC endpoint; AbCip/OpcUaServer/Host IntegrationTests need Docker fixtures). Will NOT be re-run per constraint."
    },
    {
      "id": "T15",
      "subject": "Live /run positive pass on docker-dev :9200 (rebuild BOTH centrals; auto-admin drives all page tiers; negative proof stays in T2/T3)",
      "status": "completed",
      "blockedBy": [
        "T14"
      ],
      "note": "docker-dev live authz /run; serial live pass. Heavy integration/Playwright-dependent gate \u2014 controller runs serialized. docker-dev DisableLogin=true auto-authenticates as full-access admin, so role-deny differentiation is NOT observable there; the negative proof is CI-side (T2 AdminUiPoliciesTests + T3 PageAuthorizationGuardTests, both green). This pass only regression-checks over-gating (a typo'd policy name would render the deny slot even for the auto-admin).",
      "closureNote": "LIVE GATE CLOSED 2026-07-13 (partial by design) \u2014 every config/read page renders under the all-roles multi-role-test session, so named-policy gating does not over-gate a legitimate admin. The DENY direction is unobservable on docker-dev (DisableLogin=true), as documented."
    },
    {
      "id": "T16",
      "subject": "Merge + bookkeeping (flip 04/C-1 row, record Reservations/ClusterRedundancy corrections)",
      "status": "completed",
      "blockedBy": [
        "T15"
      ]
    }
  ]
}