fix(SEC-41, SEC-40): re-resolve dashboard tag grants; gate the alarm feed on a real role
Committed together because the two changes share the same doc paragraphs (the ACL section of GatewayDashboardDesign.md, the GroupToTag / AllowAnonymousLocalhost rows of GatewayConfiguration.md, and CLAUDE.md's authentication paragraph), and splitting them would leave one of the two describing behaviour that does not yet exist. SEC-41 — tag grants no longer trusted from login-stamped claims --------------------------------------------------------------- DashboardSessionAcl read the zb:dashboardtag claims stamped into the cookie at login. GatewayOptions binds once at startup, so applying a GroupToTag edit needs a restart — but the restart does not clear the auth cookie (data-protection keys persist), so a browser returning afterwards re-authenticated with tag claims resolved under the OLD map. A revoked grant therefore survived on the cookie seam for the sliding 8-hour idle life, renewable indefinitely by activity, while the hub-token seam had no such gap because its mint re-resolves. CanViewSession now re-resolves the grant on every subscribe from the caller's mxgateway:ldap_group claims through DashboardGroupTagMapping.MapGroupsToTags against the currently bound map — the same one call HubTokenService.Issue makes. Fallback (documented on the class and in the design doc): a principal carrying NO group claims falls back to its stamped tag claims. That arm exists for the hub-token principal — HubTokenService.Validate rehydrates roles and tags but not groups, so re-resolution already happened at mint, one lifetime ago at worst. It cannot re-open the cookie hole: DashboardAuthenticator stamps group and tag claims from one group list, so a cookie principal holding a tag claim always holds the groups it came from, and a login yielding no groups yields no tags. A principal with neither kind of claim stays an empty-grant Viewer. SEC-40 — the alarm feed requires a real authenticated dashboard role -------------------------------------------------------------------- AlarmsHub sat behind HubClientsPolicy, which the read-only environment bypasses satisfy, so an anonymous-localhost caller or a Mode=Disabled deployment received galaxy-wide alarm metadata — alarm reference (a full tag path), state, severity, category, area, acknowledging operator — for the whole subscription expression. Decided: tighten the gate, keep the scope. New AuthenticatedDashboardRoleRequirement + its handler, and a MxGateway.Dashboard.Alarms policy built from it. Because DashboardAuthorizationHandler is typed to DashboardAuthorizationRequirement, it is never invoked for the new type, so neither Authentication:Mode=Disabled nor anonymous localhost can satisfy the policy — the same structural device the mounted Secrets UI already relies on. The policy keeps both schemes so external hub clients can still authenticate with a bearer token, and DisableLogin auto-login is unaffected (it mints a genuinely authenticated both-roles principal). The /alarms page carries the same policy, not just the hub: it reads the same central monitor in process, so gating only the hub would have left the disclosure one navigation away. The side rail hides the Alarms link for callers the policy denies, matching the Secrets link precedent. AlarmsHubPublisher is unchanged and stays unfiltered by design — audience is decided at hub admission, and the monitor carries no per-session provenance to narrow by. Alarm metadata deliberately remains galaxy-wide for authenticated Viewers: an AlarmFeedMessage has no session id or owning key for the SEC-25 tag intersection to work against, and equating a visibility tag with an alarm-reference prefix would turn GroupToTag into the data-access constraint it explicitly is not. Tests ----- DashboardSessionAclTests: the SEC-41 regression — a cookie-style principal whose stale tag claim is no longer granted by any of its groups under the current map is denied; plus the allowing direction (including with no stamped tag at all, which proves the decision comes from the groups), the ignore-case corner, group claims that map to nothing, and the hub-token fallback asserted against an EMPTY map so dropping the fallback would fail loudly. AlarmFeedAuthorizationTests (new): both handlers run together in the most permissive environment (Mode=Disabled + loopback + AllowAnonymousLocalhost) do not satisfy the alarm requirement, with the bypassable requirement as the control so the negative cannot pass because the bypass was misconfigured; authenticated Viewer/Admin do satisfy it; an unauthenticated role claim does not; the registered policy carries the non-bypassable requirement and both schemes; and both readers — the hub type's [Authorize] and the /alarms endpoint metadata — carry it. SecretsNavRenderTests: registers the new policy (an unregistered policy name throws rather than denying in an AuthorizeView) and gains the Alarms-link negative/control pair. Verified: dotnet build src/ZB.MOM.WW.MxGateway.NonWindows.slnx (zero warnings); filtered run of the touched classes — 92 passed, 0 failed.
This commit is contained in:
Joseph Doherty
@@ -1,4 +1,5 @@
|
||||
using System.Security.Claims;
|
||||
using Microsoft.AspNetCore.Authorization;
|
||||
using Microsoft.AspNetCore.Components;
|
||||
using Microsoft.AspNetCore.Components.Authorization;
|
||||
using Microsoft.AspNetCore.Components.Web;
|
||||
@@ -13,7 +14,9 @@ using ZB.MOM.WW.Secrets.Ui;
|
||||
namespace ZB.MOM.WW.MxGateway.Tests.Dashboard;
|
||||
|
||||
/// <summary>
|
||||
/// Renders <see cref="MainLayout"/> and asserts whether the side rail emits the Secrets link.
|
||||
/// Renders <see cref="MainLayout"/> and asserts which policy-gated links the side rail emits —
|
||||
/// Secrets (<c>secrets:manage</c>) and, since SEC-40, Alarms
|
||||
/// (<see cref="DashboardAuthenticationDefaults.AlarmsPolicy"/>).
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// <para>
|
||||
@@ -39,6 +42,7 @@ namespace ZB.MOM.WW.MxGateway.Tests.Dashboard;
|
||||
public sealed class SecretsNavRenderTests
|
||||
{
|
||||
private const string SecretsHref = "/admin/secrets";
|
||||
private const string AlarmsHref = "/alarms";
|
||||
|
||||
/// <summary>
|
||||
/// The gate's proof. A Viewer holds a real, authenticated identity and still must not be offered
|
||||
@@ -95,11 +99,48 @@ public sealed class SecretsNavRenderTests
|
||||
Assert.Contains("/apikeys", html, StringComparison.Ordinal);
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// SEC-40's nav half: an anonymous caller — the read-only localhost path — is not offered the
|
||||
/// Alarms link, because the page and hub now refuse them. Same reasoning as the Secrets
|
||||
/// negative above: this is the assertion that distinguishes a gate from an inert one.
|
||||
/// </summary>
|
||||
/// <returns>A task that represents the asynchronous operation.</returns>
|
||||
[Fact]
|
||||
public async Task Rail_OmitsAlarmsLink_ForAnonymous()
|
||||
{
|
||||
string html = await RenderRailAsync();
|
||||
|
||||
Assert.DoesNotContain(AlarmsHref, html, StringComparison.Ordinal);
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// The control for that negative: an authenticated Viewer still gets the Alarms link. SEC-40
|
||||
/// excludes the environment bypasses, not Viewers — alarm metadata stays galaxy-wide for a
|
||||
/// real dashboard role because the central monitor carries no per-session provenance.
|
||||
/// </summary>
|
||||
/// <returns>A task that represents the asynchronous operation.</returns>
|
||||
[Fact]
|
||||
public async Task Rail_EmitsAlarmsLink_ForViewer()
|
||||
{
|
||||
string html = await RenderRailAsync(DashboardRoles.Viewer);
|
||||
|
||||
Assert.Contains(AlarmsHref, html, StringComparison.Ordinal);
|
||||
}
|
||||
|
||||
private static async Task<string> RenderRailAsync(params string[] roles)
|
||||
{
|
||||
var services = new ServiceCollection();
|
||||
services.AddLogging();
|
||||
services.AddAuthorization(options => options.AddSecretsAuthorization());
|
||||
services.AddAuthorization(options =>
|
||||
{
|
||||
options.AddSecretsAuthorization();
|
||||
// The rail's Alarms AuthorizeView resolves this by name; an unregistered policy throws
|
||||
// rather than denying, so it must be present for any rail render (SEC-40).
|
||||
options.AddPolicy(
|
||||
DashboardAuthenticationDefaults.AlarmsPolicy,
|
||||
policy => policy.AddRequirements(AuthenticatedDashboardRoleRequirement.AnyDashboardRole));
|
||||
});
|
||||
services.AddSingleton<IAuthorizationHandler, AuthenticatedDashboardRoleHandler>();
|
||||
services.AddCascadingAuthenticationState();
|
||||
services.AddSingleton<AuthenticationStateProvider>(new StubAuthenticationStateProvider(roles));
|
||||
services.AddSingleton<NavigationManager, StubNavigationManager>();
|
||||
|
||||
@@ -0,0 +1,198 @@
|
||||
using System.Net;
|
||||
using System.Reflection;
|
||||
using System.Security.Claims;
|
||||
using Microsoft.AspNetCore.Authorization;
|
||||
using Microsoft.AspNetCore.Builder;
|
||||
using Microsoft.AspNetCore.Http;
|
||||
using Microsoft.AspNetCore.Routing;
|
||||
using Microsoft.Extensions.DependencyInjection;
|
||||
using Microsoft.Extensions.Options;
|
||||
using ZB.MOM.WW.MxGateway.Server;
|
||||
using ZB.MOM.WW.MxGateway.Server.Configuration;
|
||||
using ZB.MOM.WW.MxGateway.Server.Dashboard;
|
||||
using ZB.MOM.WW.MxGateway.Server.Dashboard.Hubs;
|
||||
using AuthenticationOptions = ZB.MOM.WW.MxGateway.Server.Configuration.AuthenticationOptions;
|
||||
|
||||
namespace ZB.MOM.WW.MxGateway.Tests.Gateway.Dashboard;
|
||||
|
||||
/// <summary>
|
||||
/// Covers SEC-40: the alarm feed requires a real authenticated dashboard role, so the read-only
|
||||
/// environment bypasses (<c>Authentication:Mode=Disabled</c>, anonymous localhost) no longer
|
||||
/// receive galaxy-wide alarm metadata.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// The enforcement is a requirement TYPE distinction — <see cref="DashboardAuthorizationHandler"/>
|
||||
/// is an <c>AuthorizationHandler<DashboardAuthorizationRequirement></c> and therefore never
|
||||
/// runs for <see cref="AuthenticatedDashboardRoleRequirement"/> — so the tests below assert both
|
||||
/// halves: that both handlers together still deny a bypassed caller, and that the policy the two
|
||||
/// alarm surfaces actually carry is built from that requirement rather than the bypassable one.
|
||||
/// Asserting only the handler would pass even if the hub were left on the old policy.
|
||||
/// </remarks>
|
||||
public sealed class AlarmFeedAuthorizationTests
|
||||
{
|
||||
/// <summary>
|
||||
/// The bypass that satisfies <see cref="DashboardAuthorizationRequirement.AnyDashboardRole"/>
|
||||
/// — auth disabled AND a loopback request with <c>AllowAnonymousLocalhost</c> on, i.e. both
|
||||
/// arms at once — does not satisfy the alarm requirement, with the real bypass handler present
|
||||
/// in the same evaluation.
|
||||
/// </summary>
|
||||
/// <returns>A task that represents the asynchronous operation.</returns>
|
||||
[Fact]
|
||||
public async Task AlarmRequirement_AnonymousLocalhostAndAuthDisabled_DoesNotSucceed()
|
||||
{
|
||||
AuthorizationHandlerContext context = await EvaluateAsync(
|
||||
new ClaimsPrincipal(new ClaimsIdentity()),
|
||||
AuthenticatedDashboardRoleRequirement.AnyDashboardRole);
|
||||
|
||||
Assert.False(context.HasSucceeded);
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Control: the SAME evaluation environment satisfies the bypassable requirement. Without this
|
||||
/// pairing the test above could pass because the bypass was misconfigured rather than because
|
||||
/// the requirement type excludes it.
|
||||
/// </summary>
|
||||
/// <returns>A task that represents the asynchronous operation.</returns>
|
||||
[Fact]
|
||||
public async Task ViewerRequirement_AnonymousLocalhostAndAuthDisabled_StillSucceeds()
|
||||
{
|
||||
AuthorizationHandlerContext context = await EvaluateAsync(
|
||||
new ClaimsPrincipal(new ClaimsIdentity()),
|
||||
DashboardAuthorizationRequirement.AnyDashboardRole);
|
||||
|
||||
Assert.True(context.HasSucceeded);
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// An authenticated Viewer — the ordinary LDAP-logged-in dashboard user — does satisfy the
|
||||
/// alarm requirement: SEC-40 excludes the environment bypasses, not Viewers. Alarm metadata
|
||||
/// stays galaxy-wide for them because the monitor is gateway-central and carries no
|
||||
/// per-session provenance to tag-scope by.
|
||||
/// </summary>
|
||||
/// <param name="role">The dashboard role the authenticated caller holds.</param>
|
||||
/// <returns>A task that represents the asynchronous operation.</returns>
|
||||
[Theory]
|
||||
[InlineData(DashboardRoles.Viewer)]
|
||||
[InlineData(DashboardRoles.Admin)]
|
||||
public async Task AlarmRequirement_AuthenticatedDashboardRole_Succeeds(string role)
|
||||
{
|
||||
AuthorizationHandlerContext context = await EvaluateAsync(
|
||||
CreatePrincipal(role),
|
||||
AuthenticatedDashboardRoleRequirement.AnyDashboardRole);
|
||||
|
||||
Assert.True(context.HasSucceeded);
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// A principal carrying a dashboard role claim but no authentication type does not satisfy the
|
||||
/// requirement: "real role claim" means an authenticated identity, matching how the session
|
||||
/// ACL and <c>DashboardSessionAdminService</c> read a role.
|
||||
/// </summary>
|
||||
/// <returns>A task that represents the asynchronous operation.</returns>
|
||||
[Fact]
|
||||
public async Task AlarmRequirement_UnauthenticatedRoleClaim_DoesNotSucceed()
|
||||
{
|
||||
ClaimsPrincipal principal = new(new ClaimsIdentity(
|
||||
[new Claim(ClaimTypes.Role, DashboardRoles.Admin)],
|
||||
authenticationType: null,
|
||||
nameType: ClaimTypes.Name,
|
||||
roleType: ClaimTypes.Role));
|
||||
|
||||
AuthorizationHandlerContext context = await EvaluateAsync(
|
||||
principal,
|
||||
AuthenticatedDashboardRoleRequirement.AnyDashboardRole);
|
||||
|
||||
Assert.False(context.HasSucceeded);
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// The registered policy is built from the non-bypassable requirement and from neither
|
||||
/// <see cref="DashboardAuthorizationRequirement"/> nor a role list the bypass handler could
|
||||
/// reach, and it still accepts both hub-capable schemes so an external hub client can
|
||||
/// authenticate with a bearer token.
|
||||
/// </summary>
|
||||
/// <returns>A task that represents the asynchronous operation.</returns>
|
||||
[Fact]
|
||||
public async Task AlarmsPolicy_IsRegisteredWithNonBypassableRequirement()
|
||||
{
|
||||
await using WebApplication app = GatewayApplication.Build([]);
|
||||
IAuthorizationPolicyProvider provider = app.Services
|
||||
.GetRequiredService<IAuthorizationPolicyProvider>();
|
||||
|
||||
AuthorizationPolicy? policy = await provider
|
||||
.GetPolicyAsync(DashboardAuthenticationDefaults.AlarmsPolicy);
|
||||
|
||||
Assert.NotNull(policy);
|
||||
Assert.Contains(policy.Requirements, r => r is AuthenticatedDashboardRoleRequirement);
|
||||
Assert.DoesNotContain(policy.Requirements, r => r is DashboardAuthorizationRequirement);
|
||||
Assert.Equal(
|
||||
[
|
||||
DashboardAuthenticationDefaults.AuthenticationScheme,
|
||||
DashboardAuthenticationDefaults.HubAuthenticationScheme,
|
||||
],
|
||||
policy.AuthenticationSchemes);
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Both readers of the one central monitor carry the alarm policy: the hub (external clients)
|
||||
/// and the <c>/alarms</c> Razor endpoint (the in-page reader). Gating only the hub would leave
|
||||
/// the same metadata one navigation away for a bypassed caller.
|
||||
/// </summary>
|
||||
/// <returns>A task that represents the asynchronous operation.</returns>
|
||||
[Fact]
|
||||
public async Task AlarmsHubAndAlarmsPage_BothCarryTheAlarmsPolicy()
|
||||
{
|
||||
AuthorizeAttribute? hubAttribute = typeof(AlarmsHub)
|
||||
.GetCustomAttribute<AuthorizeAttribute>(inherit: false);
|
||||
|
||||
Assert.Equal(DashboardAuthenticationDefaults.AlarmsPolicy, hubAttribute?.Policy);
|
||||
|
||||
await using WebApplication app = GatewayApplication.Build([]);
|
||||
RouteEndpoint alarmsPage = ((IEndpointRouteBuilder)app).DataSources
|
||||
.SelectMany(source => source.Endpoints)
|
||||
.OfType<RouteEndpoint>()
|
||||
.Single(endpoint => endpoint.RoutePattern.RawText == "/alarms");
|
||||
|
||||
Assert.Contains(
|
||||
alarmsPage.Metadata.OfType<IAuthorizeData>(),
|
||||
data => data.Policy == DashboardAuthenticationDefaults.AlarmsPolicy);
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Runs BOTH dashboard authorization handlers over one requirement in the most permissive
|
||||
/// environment the gateway supports (auth disabled, loopback, anonymous localhost allowed),
|
||||
/// mirroring how the authorization service invokes every registered handler.
|
||||
/// </summary>
|
||||
/// <param name="principal">The caller.</param>
|
||||
/// <param name="requirement">The single requirement under evaluation.</param>
|
||||
/// <returns>The context after both handlers have run.</returns>
|
||||
private static async Task<AuthorizationHandlerContext> EvaluateAsync(
|
||||
ClaimsPrincipal principal,
|
||||
IAuthorizationRequirement requirement)
|
||||
{
|
||||
DefaultHttpContext httpContext = new();
|
||||
httpContext.Connection.RemoteIpAddress = IPAddress.Loopback;
|
||||
|
||||
IOptions<GatewayOptions> options = Options.Create(new GatewayOptions
|
||||
{
|
||||
Authentication = new AuthenticationOptions { Mode = AuthenticationMode.Disabled },
|
||||
Dashboard = new DashboardOptions { AllowAnonymousLocalhost = true },
|
||||
});
|
||||
|
||||
AuthorizationHandlerContext context = new([requirement], principal, httpContext);
|
||||
|
||||
await new DashboardAuthorizationHandler(
|
||||
new HttpContextAccessor { HttpContext = httpContext },
|
||||
options).HandleAsync(context);
|
||||
await new AuthenticatedDashboardRoleHandler().HandleAsync(context);
|
||||
|
||||
return context;
|
||||
}
|
||||
|
||||
private static ClaimsPrincipal CreatePrincipal(string role) =>
|
||||
new(new ClaimsIdentity(
|
||||
[new Claim(ClaimTypes.Role, role)],
|
||||
DashboardAuthenticationDefaults.AuthenticationScheme,
|
||||
ClaimTypes.Name,
|
||||
ClaimTypes.Role));
|
||||
}
|
||||
@@ -178,12 +178,112 @@ public sealed class DashboardSessionAclTests
|
||||
Assert.False(CreateAcl().CanViewSession(principal, TaggedSessionId));
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// SEC-41, the load-bearing regression: a cookie-style principal whose tag claim was stamped
|
||||
/// at login under an older <c>GroupToTag</c> map is DENIED once that map no longer grants the
|
||||
/// tag to any group the principal belongs to. The auth cookie survives the restart that
|
||||
/// rebinds options, so trusting the stamped claim let a config-revoked grant live on for the
|
||||
/// sliding 8-hour cookie life; the ACL now re-resolves from the group claims the same
|
||||
/// principal carries, against the currently bound map.
|
||||
/// </summary>
|
||||
[Fact]
|
||||
public void CanViewSession_StampedTagClaimRevokedFromCurrentGroupToTag_Denied()
|
||||
{
|
||||
// Current config grants team-a to nobody the caller belongs to: "plant-ops" was the group
|
||||
// whose entry was removed, and the surviving entry is for an unrelated group.
|
||||
DashboardSessionAcl acl = CreateAcl(groupToTag: new() { ["other-team"] = ["team-b"] });
|
||||
|
||||
ClaimsPrincipal stale = Principal(
|
||||
roles: [DashboardRoles.Viewer],
|
||||
tags: ["team-a"],
|
||||
groups: ["plant-ops"]);
|
||||
|
||||
Assert.False(acl.CanViewSession(stale, TaggedSessionId));
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// The re-resolution's allowing direction: the same principal is allowed when the current map
|
||||
/// still grants the session's tag to one of its groups — and is allowed even when it carries
|
||||
/// NO stamped tag claim at all, which is what proves the decision comes from the group claims
|
||||
/// rather than from the stamped ones.
|
||||
/// </summary>
|
||||
[Fact]
|
||||
public void CanViewSession_GroupClaimGrantsTagUnderCurrentMap_Allowed()
|
||||
{
|
||||
DashboardSessionAcl acl = CreateAcl(groupToTag: new() { ["plant-ops"] = ["team-a"] });
|
||||
|
||||
Assert.True(acl.CanViewSession(
|
||||
Principal(roles: [DashboardRoles.Viewer], tags: ["team-a"], groups: ["plant-ops"]),
|
||||
TaggedSessionId));
|
||||
|
||||
Assert.True(acl.CanViewSession(
|
||||
Principal(roles: [DashboardRoles.Viewer], tags: null, groups: ["plant-ops"]),
|
||||
TaggedSessionId));
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Re-resolution is ordinal-ignore-case on both sides — the group key against the map (which
|
||||
/// <see cref="DashboardGroupTagMapping"/> owns) and the resolved tag against the session's tag
|
||||
/// set. Pinned because the pre-SEC-41 claim scan got the second comparison from
|
||||
/// <c>Session.Tags</c>'s own comparer, and the re-resolution arm probes the grant set in the
|
||||
/// opposite direction.
|
||||
/// </summary>
|
||||
[Fact]
|
||||
public void CanViewSession_GroupAndTagCasingDiffer_Allowed()
|
||||
{
|
||||
DashboardSessionAcl acl = CreateAcl(groupToTag: new() { ["PLANT-OPS"] = ["TEAM-A"] });
|
||||
|
||||
Assert.True(acl.CanViewSession(
|
||||
Principal(roles: [DashboardRoles.Viewer], tags: null, groups: ["plant-ops"]),
|
||||
TaggedSessionId));
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// A principal carrying group claims that map to nothing is an empty-grant Viewer, even though
|
||||
/// it holds a stamped tag claim: once there is a group list to re-resolve from, the stamped
|
||||
/// claims are not consulted at all. This is the arm that closes the revocation gap for a user
|
||||
/// whose LDAP groups changed shape rather than whose config entry was removed.
|
||||
/// </summary>
|
||||
[Fact]
|
||||
public void CanViewSession_GroupClaimsPresentButUnmapped_IgnoresStampedTagClaim()
|
||||
{
|
||||
DashboardSessionAcl acl = CreateAcl(groupToTag: []);
|
||||
|
||||
Assert.False(acl.CanViewSession(
|
||||
Principal(roles: [DashboardRoles.Viewer], tags: ["team-a"], groups: ["plant-ops"]),
|
||||
TaggedSessionId));
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// The documented fallback: a hub-token principal carries the tags <see cref="HubTokenService"/>
|
||||
/// re-resolved at mint but no LDAP group claims to re-resolve from, so its stamped tag claims
|
||||
/// are honoured. Asserted with an EMPTY current map, which is the state that would deny if the
|
||||
/// fallback were ever dropped — and would silently break every token-authenticated hub join.
|
||||
/// </summary>
|
||||
[Fact]
|
||||
public void CanViewSession_HubTokenStylePrincipalWithNoGroupClaims_UsesStampedTags()
|
||||
{
|
||||
DashboardSessionAcl acl = CreateAcl(groupToTag: []);
|
||||
|
||||
Assert.True(acl.CanViewSession(
|
||||
Principal(roles: [DashboardRoles.Viewer], tags: ["team-a"], groups: null),
|
||||
TaggedSessionId));
|
||||
}
|
||||
|
||||
private static DashboardSessionAcl CreateAcl(
|
||||
UntaggedSessionVisibility visibility = UntaggedSessionVisibility.AdminOnly)
|
||||
UntaggedSessionVisibility visibility = UntaggedSessionVisibility.AdminOnly,
|
||||
Dictionary<string, string[]>? groupToTag = null)
|
||||
{
|
||||
GatewayOptions options = new()
|
||||
{
|
||||
Dashboard = new DashboardOptions { UntaggedSessionVisibility = visibility },
|
||||
Dashboard = new DashboardOptions
|
||||
{
|
||||
UntaggedSessionVisibility = visibility,
|
||||
// Mirrors the binder's comparer so a test's group key behaves like a config one.
|
||||
GroupToTag = groupToTag is null
|
||||
? new Dictionary<string, string[]>(StringComparer.OrdinalIgnoreCase)
|
||||
: new Dictionary<string, string[]>(groupToTag, StringComparer.OrdinalIgnoreCase),
|
||||
},
|
||||
};
|
||||
|
||||
return new DashboardSessionAcl(
|
||||
@@ -193,13 +293,26 @@ public sealed class DashboardSessionAclTests
|
||||
Options.Create(options));
|
||||
}
|
||||
|
||||
private static ClaimsPrincipal Principal(string[] roles, string[]? tags = null)
|
||||
/// <summary>
|
||||
/// Builds a dashboard principal. <paramref name="groups"/> is the SEC-41 discriminator: a
|
||||
/// principal WITH group claims is re-resolved against the current map (the cookie seam), one
|
||||
/// WITHOUT falls back to its stamped tag claims (the hub-token seam). Existing cases pass
|
||||
/// tags only, so they continue to exercise the fallback arm exactly as before.
|
||||
/// </summary>
|
||||
/// <param name="roles">Role claims to stamp.</param>
|
||||
/// <param name="tags">Login-stamped visibility tag claims, if any.</param>
|
||||
/// <param name="groups">LDAP group claims, if any.</param>
|
||||
/// <returns>An authenticated principal carrying the requested claims.</returns>
|
||||
private static ClaimsPrincipal Principal(string[] roles, string[]? tags = null, string[]? groups = null)
|
||||
{
|
||||
List<Claim> claims = [new Claim(ClaimTypes.Name, "viewer-user")];
|
||||
claims.AddRange(roles.Select(role => new Claim(ClaimTypes.Role, role)));
|
||||
claims.AddRange((tags ?? []).Select(tag => new Claim(
|
||||
DashboardAuthenticationDefaults.DashboardTagClaimType,
|
||||
tag)));
|
||||
claims.AddRange((groups ?? []).Select(group => new Claim(
|
||||
DashboardAuthenticationDefaults.LdapGroupClaimType,
|
||||
group)));
|
||||
|
||||
return new ClaimsPrincipal(new ClaimsIdentity(
|
||||
claims,
|
||||
|
||||
Reference in New Issue
Block a user