Files
lmxopcua/docs/plans
Joseph Doherty 804c32e5c0 docs(acl): design for API-key identity + node ACL enforcement (#520)
Owner decisions 2026-07-31: the OPC UA data plane is machine-to-machine, so
identity is an API key with a static username rather than an LDAP user; LDAP is
replaced entirely on the data plane (AdminUI login keeps its own); and Anonymous
becomes a normal grantable principal behind an enable setting rather than a
special case in the evaluator.

Re-verified all six of #520's claims on master first — they still hold.

The identity decision dissolves blocker #2 (session carries roles, not groups)
rather than solving it. Blocker #1 (raw-realm nodes have no representable
NodeScope) turns out to be tractable: NodeAclScopeKind already carries Namespace
and FolderSegment, so adding NodeHierarchyKind.Raw over the RawPath segments
makes FolderSegment matchable for the first time.

Seam survey corrects #520 in both directions: HistoryRead already has four
overrides to hang a check on, but Read/Browse/Subscribe genuinely have none and
sit on the hot publish path, so decisions must be cached per session+node.

Records two things the issue did not: enforcement ships behind a default-off
Security:Acl:Enabled dark switch (otherwise the first deploy silently denies
ScadaBridge, which consumes this address space from another repo), and because
Phase 4 leaves driver-only nodes with no ConfigDb, keys ride the deployment
artifact — so key revocation requires a deploy.

Claude-Session: https://claude.ai/code/session_015p7wGqy3YpZNCpDzTpGMKo
2026-07-31 12:12:35 -04:00
..