40fb459040
Ships Stream B.1-B.6 — the data-plane authorization engine Phase 6.2 runs on.
Integration into OPC UA dispatch (Stream C — Read / Write / HistoryRead /
Subscribe / Browse / Call etc.) is the next PR on this branch.
New Core.Abstractions:
- OpcUaOperation enum enumerates every OPC UA surface the evaluator gates:
Browse, Read, WriteOperate/Tune/Configure (split by SecurityClassification),
HistoryRead, HistoryUpdate, CreateMonitoredItems, TransferSubscriptions,
Call, AlarmAcknowledge/Confirm/Shelve. Stream C maps each one back to its
dispatch call site.
New Core.Authorization namespace:
- NodeScope record + NodeHierarchyKind — 6-level scope addressing for
Equipment-kind (UNS) namespaces, folder-segment walk for SystemPlatform-kind
(Galaxy). NodeScope carries a Kind selector so the evaluator knows which
hierarchy to descend.
- AuthorizationDecision { Verdict, Provenance } + AuthorizationVerdict
{Allow, NotGranted, Denied} + MatchedGrant. Tri-state per decision #149;
Phase 6.2 only produces Allow + NotGranted, Denied stays reserved for v2.1
Explicit Deny without API break.
- IPermissionEvaluator.Authorize(session, operation, scope).
- PermissionTrie + PermissionTrieNode + TrieGrant. In-memory trie keyed on
the ACL scope hierarchy. CollectMatches walks Cluster → Namespace →
UnsArea → UnsLine → Equipment → Tag (or → FolderSegment(s) → Tag on
Galaxy). Pure additive union — matches that share an LDAP group with the
session contribute flags; OR across levels.
- PermissionTrieBuilder static factory. Build(clusterId, generationId, rows,
scopePaths?) returns a trie for one generation. Cross-cluster rows are
filtered out so the trie is cluster-coherent. Stream C follow-up wires a
real scopePaths lookup from the live DB; tests supply hand-built paths.
- PermissionTrieCache — process-singleton, keyed on (ClusterId, GenerationId).
Install(trie) adds a generation + promotes to "current" when the id is
highest-known (handles out-of-order installs gracefully). Prior generations
retained so an in-flight request against a prior trie still succeeds; GC
via Prune(cluster, keepLatest).
- UserAuthorizationState — per-session cache of resolved LDAP groups +
AuthGenerationId + MembershipVersion + MembershipResolvedUtc. Bounded by
MembershipFreshnessInterval (default 15 min per decision #151) +
AuthCacheMaxStaleness (default 5 min per decision #152).
- TriePermissionEvaluator — default IPermissionEvaluator. Fails closed on
stale sessions (IsStale check short-circuits to NotGranted), on cross-
cluster requests, on empty trie cache. Maps OpcUaOperation → NodePermissions
via MapOperationToPermission (total — every enum value has a mapping; tested).
Tests (27 new, all pass):
- PermissionTrieTests (7): cluster-level grant cascades to every tag;
equipment-level grant doesn't leak to sibling equipment; multi-group union
ORs flags; no-matching-group returns empty; Galaxy folder-segment grant
doesn't leak to sibling folder; cross-cluster rows don't land in this
cluster's trie; build is idempotent (B.6 invariants).
- TriePermissionEvaluatorTests (8): allow when flag matches; NotGranted when
no matching group; NotGranted when flags insufficient; HistoryRead requires
its own bit (decision-level requirement); cross-cluster session denied;
stale session fails closed; no cached trie denied; MapOperationToPermission
is total across every OpcUaOperation.
- PermissionTrieCacheTests (8): empty cache returns null; install-then-get
round-trips; new generation becomes current; out-of-order install doesn't
downgrade current; invalidate drops one cluster; prune retains most recent;
prune no-op when fewer than keep; cluster isolation.
- UserAuthorizationStateTests (4): fresh is not stale; IsStale after 5 min
default; NeedsRefresh true between freshness + staleness windows.
Full solution dotnet test: 1078 passing (baseline 906, Phase 6.1 = 1042,
Phase 6.2 Stream A = +9, Stream B = +27 = 1078). Pre-existing Client.CLI
Subscribe flake unchanged.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
105 lines
2.9 KiB
C#
105 lines
2.9 KiB
C#
using Shouldly;
|
|
using Xunit;
|
|
using ZB.MOM.WW.OtOpcUa.Core.Authorization;
|
|
|
|
namespace ZB.MOM.WW.OtOpcUa.Core.Tests.Authorization;
|
|
|
|
[Trait("Category", "Unit")]
|
|
public sealed class PermissionTrieCacheTests
|
|
{
|
|
private static PermissionTrie Trie(string cluster, long generation) => new()
|
|
{
|
|
ClusterId = cluster,
|
|
GenerationId = generation,
|
|
};
|
|
|
|
[Fact]
|
|
public void GetTrie_Empty_ReturnsNull()
|
|
{
|
|
new PermissionTrieCache().GetTrie("c1").ShouldBeNull();
|
|
}
|
|
|
|
[Fact]
|
|
public void Install_ThenGet_RoundTrips()
|
|
{
|
|
var cache = new PermissionTrieCache();
|
|
cache.Install(Trie("c1", 5));
|
|
|
|
cache.GetTrie("c1")!.GenerationId.ShouldBe(5);
|
|
cache.CurrentGenerationId("c1").ShouldBe(5);
|
|
}
|
|
|
|
[Fact]
|
|
public void NewGeneration_BecomesCurrent()
|
|
{
|
|
var cache = new PermissionTrieCache();
|
|
cache.Install(Trie("c1", 1));
|
|
cache.Install(Trie("c1", 2));
|
|
|
|
cache.CurrentGenerationId("c1").ShouldBe(2);
|
|
cache.GetTrie("c1", 1).ShouldNotBeNull("prior generation retained for in-flight requests");
|
|
cache.GetTrie("c1", 2).ShouldNotBeNull();
|
|
}
|
|
|
|
[Fact]
|
|
public void OutOfOrder_Install_DoesNotDowngrade_Current()
|
|
{
|
|
var cache = new PermissionTrieCache();
|
|
cache.Install(Trie("c1", 3));
|
|
cache.Install(Trie("c1", 1)); // late-arriving older generation
|
|
|
|
cache.CurrentGenerationId("c1").ShouldBe(3, "older generation must not become current");
|
|
cache.GetTrie("c1", 1).ShouldNotBeNull("but older is still retrievable by explicit lookup");
|
|
}
|
|
|
|
[Fact]
|
|
public void Invalidate_DropsCluster()
|
|
{
|
|
var cache = new PermissionTrieCache();
|
|
cache.Install(Trie("c1", 1));
|
|
cache.Install(Trie("c2", 1));
|
|
|
|
cache.Invalidate("c1");
|
|
|
|
cache.GetTrie("c1").ShouldBeNull();
|
|
cache.GetTrie("c2").ShouldNotBeNull("sibling cluster unaffected");
|
|
}
|
|
|
|
[Fact]
|
|
public void Prune_RetainsMostRecent()
|
|
{
|
|
var cache = new PermissionTrieCache();
|
|
for (var g = 1L; g <= 5; g++) cache.Install(Trie("c1", g));
|
|
|
|
cache.Prune("c1", keepLatest: 2);
|
|
|
|
cache.GetTrie("c1", 5).ShouldNotBeNull();
|
|
cache.GetTrie("c1", 4).ShouldNotBeNull();
|
|
cache.GetTrie("c1", 3).ShouldBeNull();
|
|
cache.GetTrie("c1", 1).ShouldBeNull();
|
|
}
|
|
|
|
[Fact]
|
|
public void Prune_LessThanKeep_IsNoOp()
|
|
{
|
|
var cache = new PermissionTrieCache();
|
|
cache.Install(Trie("c1", 1));
|
|
cache.Install(Trie("c1", 2));
|
|
|
|
cache.Prune("c1", keepLatest: 10);
|
|
|
|
cache.CachedTrieCount.ShouldBe(2);
|
|
}
|
|
|
|
[Fact]
|
|
public void ClusterIsolation()
|
|
{
|
|
var cache = new PermissionTrieCache();
|
|
cache.Install(Trie("c1", 1));
|
|
cache.Install(Trie("c2", 9));
|
|
|
|
cache.CurrentGenerationId("c1").ShouldBe(1);
|
|
cache.CurrentGenerationId("c2").ShouldBe(9);
|
|
}
|
|
}
|