Joseph Doherty
98b27fc1b6
- AdminUI-001: gate Script editor pages at Administrator,Designer + loosen ScriptAnalysis backend to match - AdminUI-004: explicit [Authorize] on FleetStatus/Alert/ScriptLog hubs - Core.AlarmHistorian-014: ObjectDisposedException guards on GetStatus/RetryDeadLettered (+ regression test) - Core.Scripting.Abstractions-004/-007: Deadband tolerance doc + stale ScriptedAlarms.md path - Host-003: correct config-overlay precedence in ServiceHosting.md - Configuration-014: LdapGroupRoleMapping collation-dependency doc - Driver.TwinCAT.Contracts-002: Structure enum doc (discovery-only sentinel)
61 lines
3.4 KiB
C#
61 lines
3.4 KiB
C#
using ZB.MOM.WW.OtOpcUa.Configuration.Entities;
|
|
using ZB.MOM.WW.OtOpcUa.Configuration.Enums;
|
|
|
|
namespace ZB.MOM.WW.OtOpcUa.Configuration.Services;
|
|
|
|
/// <summary>
|
|
/// CRUD surface for <see cref="LdapGroupRoleMapping"/> — the control-plane mapping from
|
|
/// LDAP groups to Admin UI roles. Consumed only by Admin UI code paths; the OPC UA
|
|
/// data-path evaluator MUST NOT depend on this interface (see decision #150 and the
|
|
/// Phase 6.2 compliance check on control/data-plane separation).
|
|
/// </summary>
|
|
/// <remarks>
|
|
/// Per Phase 6.2 Stream A.2 this service is expected to run behind the Phase 6.1
|
|
/// <c>ResilientConfigReader</c> pipeline (timeout → retry → fallback-to-cache) so a
|
|
/// transient DB outage during sign-in falls back to the sealed snapshot rather than
|
|
/// denying every login.
|
|
/// </remarks>
|
|
public interface ILdapGroupRoleMappingService
|
|
{
|
|
/// <summary>List every mapping whose LDAP group matches one of <paramref name="ldapGroups"/>.</summary>
|
|
/// <remarks>
|
|
/// Hot path — fires on every sign-in. The default EF implementation relies on the
|
|
/// <c>IX_LdapGroupRoleMapping_Group</c> index. The match is a SQL <c>IN (…)</c> whose
|
|
/// case-sensitivity is determined by the <c>LdapGroup</c> column collation. Case-insensitive
|
|
/// behaviour requires a case-insensitive (CI) server or column collation — this is a
|
|
/// deployment requirement. On a case-sensitive-collation server the lookup will silently
|
|
/// miss rows that differ only in case.
|
|
/// </remarks>
|
|
/// <param name="ldapGroups">The LDAP groups to search for.</param>
|
|
/// <param name="cancellationToken">The cancellation token.</param>
|
|
Task<IReadOnlyList<LdapGroupRoleMapping>> GetByGroupsAsync(
|
|
IEnumerable<string> ldapGroups, CancellationToken cancellationToken);
|
|
|
|
/// <summary>Enumerate every mapping; Admin UI listing only.</summary>
|
|
/// <param name="cancellationToken">The cancellation token.</param>
|
|
Task<IReadOnlyList<LdapGroupRoleMapping>> ListAllAsync(CancellationToken cancellationToken);
|
|
|
|
/// <summary>Create a new grant.</summary>
|
|
/// <exception cref="InvalidLdapGroupRoleMappingException">
|
|
/// Thrown when the proposed row violates an invariant (IsSystemWide inconsistent with
|
|
/// ClusterId, duplicate (group, cluster) pair, etc.) — ValidatedLdapGroupRoleMappingService
|
|
/// is the write surface that enforces these; the raw service here surfaces DB-level violations.
|
|
/// </exception>
|
|
/// <param name="row">The LDAP group role mapping to create.</param>
|
|
/// <param name="cancellationToken">The cancellation token.</param>
|
|
Task<LdapGroupRoleMapping> CreateAsync(LdapGroupRoleMapping row, CancellationToken cancellationToken);
|
|
|
|
/// <summary>Delete a mapping by its surrogate key.</summary>
|
|
/// <param name="id">The unique identifier of the mapping to delete.</param>
|
|
/// <param name="cancellationToken">The cancellation token.</param>
|
|
Task DeleteAsync(Guid id, CancellationToken cancellationToken);
|
|
}
|
|
|
|
/// <summary>Thrown when <see cref="LdapGroupRoleMapping"/> authoring violates an invariant.</summary>
|
|
public sealed class InvalidLdapGroupRoleMappingException : Exception
|
|
{
|
|
/// <summary>Initializes a new instance of the InvalidLdapGroupRoleMappingException.</summary>
|
|
/// <param name="message">The error message.</param>
|
|
public InvalidLdapGroupRoleMappingException(string message) : base(message) { }
|
|
}
|