feat(alarms): structural degraded-status signal for truncated alarm snapshots

The truncation-cliff fix made alarm transitions truncation-safe but silent: when GetXmlCurrentAlarms2 returns exactly maxAlmCnt records the worker suppresses absence-implies-Clear inference and says so only in a rate-limited stderr warning. No client and no operator could tell a complete active set from a capped one. Two additive proto3 booleans carry the verdict out: - QueryActiveAlarmsReplyPayload.snapshot_truncated = 2 (worker IPC reply) - ActiveAlarmSnapshot.from_truncated_snapshot = 16 (per record) The per-record field is not an aesthetic choice. QueryActiveAlarms returns a bare `stream ActiveAlarmSnapshot` with no envelope, header, or trailer, so a per-record boolean is the only carrier that stays wire-compatible; an envelope message would change every existing client's stream element type. The reply payload states it too because a prefix filter can leave zero records and a truncated fetch with nothing to report still has to say so. The flag means "this set may be incomplete", never "this record is unreliable" — it is independent of the subtag-fallback `degraded` field. Detection is deliberately UNCHANGED: IsTruncatedFetch remains `fetchedRecordCount >= maxAlarmsPerFetch`. The live probe (docs/AlarmProbeFindings.md, ce5d8ae) could not verify whether ALARM_RECORDS/@COUNT reports the total active count or only the records in the reply, so @COUNT is not parsed for detection; switching to it stays blocked on probe evidence. The probe's comment annotations in WnWrapAlarmConsumer.cs are preserved. Reset semantics: not latched. WnWrapAlarmConsumer.FoldFetch replaces the verdict on every poll under the same lock as the snapshot merge, so the first sub-cap fetch clears it; GatewayAlarmMonitor.ClearCache drops it with the cache generation it describes. A caveat that never turns off is one operators learn to ignore. Flow: WnWrapAlarmConsumer.LastSnapshotTruncated -> AlarmDispatcher (stamps every record) / IAlarmCommandHandler (payload) -> MxAccessCommandExecutor reply -> GatewayAlarmMonitor._snapshotTruncated -> IGatewayAlarmService.SnapshotTruncated -> DashboardAlarmQueryResult -> AlarmsPage warning banner (render-side only; the poll loop and DisposeAsync drain are untouched). The public QueryActiveAlarms RPC forwards worker snapshots unmodified, so the per-record flag needed no mapper change — a test pins that. Parity: this describes OUR fetch mechanics — additive gateway metadata — not MXAccess provider behavior. No event is synthesized and no MXAccess-observable semantics change, so it is not a parity deviation. Tests: worker LastSnapshotTruncated set/reset/consecutive-burst (windev-run); gateway end-to-end truncated reply -> monitor -> public stream, with the complete-reply control as the load-bearing assertion; AlarmsPage banner present/absent. Docs: gateway.md alarm surface, docs/DesignDecisions.md entry.
2026-08-17 04:18:34 -04:00
parent b8b7b69ba0
commit 693a78db7d
41 changed files with 2217 additions and 309 deletions
@@ -291,6 +291,7 @@ public sealed class DashboardAuthenticatorTests
        return new DashboardAuthenticator(
            ldapAuthService,
            roleMapper,
+            Options.Create(options),
            NullLogger<DashboardAuthenticator>.Instance);
    }

@@ -0,0 +1,264 @@
+using System.Diagnostics.CodeAnalysis;
+using System.Security.Claims;
+using Microsoft.Extensions.Options;
+using ZB.MOM.WW.MxGateway.Contracts.Proto;
+using ZB.MOM.WW.MxGateway.Server.Configuration;
+using ZB.MOM.WW.MxGateway.Server.Dashboard;
+using ZB.MOM.WW.MxGateway.Server.Sessions;
+
+namespace ZB.MOM.WW.MxGateway.Tests.Gateway.Dashboard;
+
+/// <summary>
+/// Covers <see cref="DashboardSessionAcl"/>, the single decision both dashboard subscribe seams
+/// consult (SEC-25 / TST-15).
+/// </summary>
+/// <remarks>
+/// Every branch is asserted in its denying direction as well as its allowing one, because the
+/// pre-ACL behaviour was "allow everything": an assertion that a permitted caller is permitted
+/// cannot distinguish a working gate from no gate at all.
+/// </remarks>
+public sealed class DashboardSessionAclTests
+{
+    private const string TaggedSessionId = "session-tagged";
+    private const string UntaggedSessionId = "session-untagged";
+
+    /// <summary>An Administrator bypasses the tag check entirely, including for a tag they hold none of.</summary>
+    [Fact]
+    public void CanViewSession_Administrator_BypassesTagCheck()
+    {
+        DashboardSessionAcl acl = CreateAcl();
+
+        Assert.True(acl.CanViewSession(Principal(roles: [DashboardRoles.Admin]), TaggedSessionId));
+        Assert.True(acl.CanViewSession(Principal(roles: [DashboardRoles.Admin]), UntaggedSessionId));
+    }
+
+    /// <summary>
+    /// The admin bypass is what keeps <c>Dashboard:DisableLogin</c> auto-login (which stamps both
+    /// roles and no tags) working exactly as before this change.
+    /// </summary>
+    [Fact]
+    public void CanViewSession_AutoLoginStyleBothRolesNoTags_Allowed()
+    {
+        DashboardSessionAcl acl = CreateAcl();
+
+        Assert.True(acl.CanViewSession(
+            Principal(roles: [DashboardRoles.Admin, DashboardRoles.Viewer]),
+            TaggedSessionId));
+    }
+
+    /// <summary>
+    /// An unknown session id is denied even for a caller holding every configured tag: no
+    /// subscription is created for a session the registry does not have.
+    /// </summary>
+    [Fact]
+    public void CanViewSession_UnknownSession_Denied()
+    {
+        DashboardSessionAcl acl = CreateAcl();
+
+        Assert.False(acl.CanViewSession(
+            Principal(roles: [DashboardRoles.Viewer], tags: ["team-a", "team-b"]),
+            "session-does-not-exist"));
+    }
+
+    /// <summary>A blank session id is denied without consulting anything.</summary>
+    [Theory]
+    [InlineData("")]
+    [InlineData("   ")]
+    public void CanViewSession_BlankSessionId_Denied(string sessionId)
+    {
+        DashboardSessionAcl acl = CreateAcl();
+
+        Assert.False(acl.CanViewSession(Principal(roles: [DashboardRoles.Admin]), sessionId));
+    }
+
+    /// <summary>A null principal denies — the fail-closed reading of an unauthenticated hub context.</summary>
+    [Fact]
+    public void CanViewSession_NullPrincipal_Denied()
+    {
+        DashboardSessionAcl acl = CreateAcl();
+
+        Assert.False(acl.CanViewSession(null, UntaggedSessionId));
+    }
+
+    /// <summary>
+    /// Untagged sessions follow <c>Dashboard:UntaggedSessionVisibility</c>: hidden from Viewers
+    /// under the shipped <see cref="UntaggedSessionVisibility.AdminOnly"/> default, visible under
+    /// the opt-in <see cref="UntaggedSessionVisibility.AllViewers"/>.
+    /// </summary>
+    /// <param name="visibility">The configured untagged-session visibility.</param>
+    /// <param name="expected">Whether a tagless Viewer may observe the untagged session.</param>
+    [Theory]
+    [InlineData(UntaggedSessionVisibility.AdminOnly, false)]
+    [InlineData(UntaggedSessionVisibility.AllViewers, true)]
+    public void CanViewSession_UntaggedSession_FollowsConfiguredVisibility(
+        UntaggedSessionVisibility visibility,
+        bool expected)
+    {
+        DashboardSessionAcl acl = CreateAcl(visibility);
+
+        Assert.Equal(
+            expected,
+            acl.CanViewSession(Principal(roles: [DashboardRoles.Viewer]), UntaggedSessionId));
+    }
+
+    /// <summary>
+    /// A Viewer whose grant intersects the session's tags is allowed; the comparison is
+    /// ordinal-ignore-case, matching the session's tag set and the config map.
+    /// </summary>
+    /// <param name="grantedTag">The single tag the Viewer holds.</param>
+    [Theory]
+    [InlineData("team-a")]
+    [InlineData("TEAM-A")]
+    public void CanViewSession_ViewerGrantIntersectsSessionTags_Allowed(string grantedTag)
+    {
+        DashboardSessionAcl acl = CreateAcl();
+
+        Assert.True(acl.CanViewSession(
+            Principal(roles: [DashboardRoles.Viewer], tags: [grantedTag]),
+            TaggedSessionId));
+    }
+
+    /// <summary>A Viewer holding only another tenant's tag is denied — the load-bearing negative.</summary>
+    [Fact]
+    public void CanViewSession_ViewerGrantDisjointFromSessionTags_Denied()
+    {
+        DashboardSessionAcl acl = CreateAcl();
+
+        Assert.False(acl.CanViewSession(
+            Principal(roles: [DashboardRoles.Viewer], tags: ["team-b"]),
+            TaggedSessionId));
+    }
+
+    /// <summary>
+    /// A principal carrying no tag claims — the anonymous-localhost / empty-grant Viewer of
+    /// SEC-02 — sees a tagged session never, and an untagged one only when the operator opted
+    /// into <see cref="UntaggedSessionVisibility.AllViewers"/>.
+    /// </summary>
+    [Fact]
+    public void CanViewSession_NoTagClaims_IsEmptyGrantViewer()
+    {
+        ClaimsPrincipal anonymous = new(new ClaimsIdentity());
+
+        Assert.False(CreateAcl().CanViewSession(anonymous, TaggedSessionId));
+        Assert.False(CreateAcl(UntaggedSessionVisibility.AdminOnly).CanViewSession(anonymous, UntaggedSessionId));
+        Assert.True(CreateAcl(UntaggedSessionVisibility.AllViewers).CanViewSession(anonymous, UntaggedSessionId));
+    }
+
+    /// <summary>
+    /// An unauthenticated principal that nonetheless carries an Administrator role claim does not
+    /// get the bypass: the bypass requires a real authenticated identity, as elsewhere in the
+    /// dashboard (<c>DashboardSessionAdminService.CanManage</c>).
+    /// </summary>
+    [Fact]
+    public void CanViewSession_UnauthenticatedAdminRoleClaim_DoesNotBypass()
+    {
+        // No authentication type => IsAuthenticated is false.
+        ClaimsPrincipal principal = new(new ClaimsIdentity(
+            [new Claim(ClaimTypes.Role, DashboardRoles.Admin)],
+            authenticationType: null,
+            nameType: ClaimTypes.Name,
+            roleType: ClaimTypes.Role));
+
+        Assert.False(CreateAcl().CanViewSession(principal, TaggedSessionId));
+    }
+
+    private static DashboardSessionAcl CreateAcl(
+        UntaggedSessionVisibility visibility = UntaggedSessionVisibility.AdminOnly)
+    {
+        GatewayOptions options = new()
+        {
+            Dashboard = new DashboardOptions { UntaggedSessionVisibility = visibility },
+        };
+
+        return new DashboardSessionAcl(
+            new TwoSessionManager(
+                CreateSession(TaggedSessionId, ["team-a"]),
+                CreateSession(UntaggedSessionId, tags: null)),
+            Options.Create(options));
+    }
+
+    private static ClaimsPrincipal Principal(string[] roles, string[]? tags = null)
+    {
+        List<Claim> claims = [new Claim(ClaimTypes.Name, "viewer-user")];
+        claims.AddRange(roles.Select(role => new Claim(ClaimTypes.Role, role)));
+        claims.AddRange((tags ?? []).Select(tag => new Claim(
+            DashboardAuthenticationDefaults.DashboardTagClaimType,
+            tag)));
+
+        return new ClaimsPrincipal(new ClaimsIdentity(
+            claims,
+            authenticationType: "test",
+            nameType: ClaimTypes.Name,
+            roleType: ClaimTypes.Role));
+    }
+
+    private static GatewaySession CreateSession(string sessionId, string[]? tags)
+    {
+        return new GatewaySession(
+            sessionId: sessionId,
+            backendName: "backend",
+            pipeName: $"pipe-{sessionId}",
+            nonce: "nonce",
+            clientIdentity: "client",
+            ownerKeyId: "key-1",
+            clientSessionName: "client-session",
+            clientCorrelationId: "correlation",
+            commandTimeout: TimeSpan.FromSeconds(5),
+            startupTimeout: TimeSpan.FromSeconds(5),
+            shutdownTimeout: TimeSpan.FromSeconds(5),
+            leaseDuration: TimeSpan.FromMinutes(30),
+            openedAt: DateTimeOffset.UnixEpoch,
+            ownerDashboardTags: tags);
+    }
+
+    /// <summary>Registry double serving exactly the two sessions the ACL cases need.</summary>
+    private sealed class TwoSessionManager(GatewaySession tagged, GatewaySession untagged) : ISessionManager
+    {
+        /// <inheritdoc />
+        public Task<GatewaySession> OpenSessionAsync(
+            SessionOpenRequest request,
+            string? clientIdentity,
+            string? ownerKeyId,
+            CancellationToken cancellationToken) => Task.FromResult(tagged);
+
+        /// <inheritdoc />
+        public bool TryGetSession(string sessionId, [MaybeNullWhen(false)] out GatewaySession session)
+        {
+            session = sessionId switch
+            {
+                TaggedSessionId => tagged,
+                UntaggedSessionId => untagged,
+                _ => null,
+            };
+
+            return session is not null;
+        }
+
+        /// <inheritdoc />
+        public Task<WorkerCommandReply> InvokeAsync(
+            string sessionId,
+            WorkerCommand command,
+            CancellationToken cancellationToken) => Task.FromResult(new WorkerCommandReply());
+
+        /// <inheritdoc />
+        public Task<SessionCloseResult> CloseSessionAsync(
+            string sessionId,
+            CancellationToken cancellationToken) =>
+            Task.FromResult(new SessionCloseResult(sessionId, SessionState.Closed, AlreadyClosed: false));
+
+        /// <inheritdoc />
+        public Task<SessionCloseResult> KillWorkerAsync(
+            string sessionId,
+            string reason,
+            CancellationToken cancellationToken) =>
+            Task.FromResult(new SessionCloseResult(sessionId, SessionState.Closed, AlreadyClosed: false));
+
+        /// <inheritdoc />
+        public Task<int> CloseExpiredLeasesAsync(
+            DateTimeOffset now,
+            CancellationToken cancellationToken) => Task.FromResult(0);
+
+        /// <inheritdoc />
+        public Task ShutdownAsync(CancellationToken cancellationToken) => Task.CompletedTask;
+    }
+}
@@ -0,0 +1,175 @@
+using System.Security.Claims;
+using Microsoft.AspNetCore.Http.Features;
+using Microsoft.AspNetCore.SignalR;
+using ZB.MOM.WW.MxGateway.Server.Dashboard;
+using ZB.MOM.WW.MxGateway.Server.Dashboard.Hubs;
+
+namespace ZB.MOM.WW.MxGateway.Tests.Gateway.Dashboard;
+
+/// <summary>
+/// Covers the ACL gate on <see cref="EventsHub.SubscribeSession"/> (SEC-25 / TST-15).
+/// </summary>
+/// <remarks>
+/// The denial assertions are the load-bearing ones — before the gate existed every caller was
+/// joined, so "an allowed caller is joined" is indistinguishable from no gate. They assert the
+/// absence of BOTH effects of a join: the SignalR group membership and the viewer registration
+/// that turns the broadcaster's mirror on for the session. Leaving either behind would keep the
+/// event clone running for a caller who may not observe it.
+/// </remarks>
+public sealed class EventsHubTests
+{
+    private const string SessionId = "session-1";
+    private const string ConnectionId = "connection-1";
+
+    private static readonly ClaimsPrincipal TestPrincipal = new(new ClaimsIdentity(
+        [new Claim(ClaimTypes.Name, "viewer-user")],
+        authenticationType: "test"));
+
+    /// <summary>An allowed caller joins the group and registers as a viewer.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
+    [Fact]
+    public async Task SubscribeSession_WhenAclAllows_JoinsGroupAndRegistersViewer()
+    {
+        EventsHubViewerRegistry registry = new();
+        RecordingGroupManager groups = new();
+        EventsHub hub = CreateHub(registry, groups, allow: true);
+
+        await hub.SubscribeSession(SessionId);
+
+        Assert.Equal([(ConnectionId, EventsHub.GroupName(SessionId))], groups.Added);
+        Assert.True(registry.HasViewers(SessionId));
+    }
+
+    /// <summary>
+    /// A denied caller gets a <see cref="HubException"/>, is not joined, and is not registered.
+    /// </summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
+    [Fact]
+    public async Task SubscribeSession_WhenAclDenies_ThrowsAndDoesNotJoin()
+    {
+        EventsHubViewerRegistry registry = new();
+        RecordingGroupManager groups = new();
+        EventsHub hub = CreateHub(registry, groups, allow: false);
+
+        HubException error = await Assert.ThrowsAsync<HubException>(() => hub.SubscribeSession(SessionId));
+
+        Assert.Equal("Not authorized for this session.", error.Message);
+        Assert.Empty(groups.Added);
+        Assert.False(registry.HasViewers(SessionId));
+    }
+
+    /// <summary>
+    /// A blank session id is still a no-op rather than a denial, so a client that sends one is not
+    /// told it lacks authorization for a session it never named.
+    /// </summary>
+    /// <param name="sessionId">The blank session id supplied by the caller.</param>
+    /// <returns>A task that represents the asynchronous operation.</returns>
+    [Theory]
+    [InlineData("")]
+    [InlineData("   ")]
+    public async Task SubscribeSession_BlankSessionId_IsNoOp(string sessionId)
+    {
+        EventsHubViewerRegistry registry = new();
+        RecordingGroupManager groups = new();
+        EventsHub hub = CreateHub(registry, groups, allow: false);
+
+        await hub.SubscribeSession(sessionId);
+
+        Assert.Empty(groups.Added);
+    }
+
+    /// <summary>The ACL is asked about the session the caller named, with the caller's own principal.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
+    [Fact]
+    public async Task SubscribeSession_AsksAclAboutTheRequestedSession()
+    {
+        StubSessionAcl acl = new(allow: true);
+        EventsHub hub = new(new EventsHubViewerRegistry(), acl)
+        {
+            Groups = new RecordingGroupManager(),
+            Context = new StubHubCallerContext(ConnectionId, TestPrincipal),
+        };
+
+        await hub.SubscribeSession(SessionId);
+
+        Assert.Equal(SessionId, acl.LastSessionId);
+        Assert.Same(TestPrincipal, acl.LastPrincipal);
+    }
+
+    private static EventsHub CreateHub(
+        EventsHubViewerRegistry registry,
+        RecordingGroupManager groups,
+        bool allow)
+    {
+        return new EventsHub(registry, new StubSessionAcl(allow))
+        {
+            Groups = groups,
+            Context = new StubHubCallerContext(ConnectionId, TestPrincipal),
+        };
+    }
+
+    private sealed class StubSessionAcl(bool allow) : IDashboardSessionAcl
+    {
+        /// <summary>Gets the principal passed to the most recent call.</summary>
+        public ClaimsPrincipal? LastPrincipal { get; private set; }
+
+        /// <summary>Gets the session id passed to the most recent call.</summary>
+        public string? LastSessionId { get; private set; }
+
+        /// <inheritdoc />
+        public bool CanViewSession(ClaimsPrincipal? principal, string sessionId)
+        {
+            LastPrincipal = principal;
+            LastSessionId = sessionId;
+
+            return allow;
+        }
+    }
+
+    private sealed class RecordingGroupManager : IGroupManager
+    {
+        /// <summary>Gets the (connection id, group name) pairs added, in order.</summary>
+        public List<(string ConnectionId, string GroupName)> Added { get; } = [];
+
+        /// <inheritdoc />
+        public Task AddToGroupAsync(string connectionId, string groupName, CancellationToken cancellationToken = default)
+        {
+            Added.Add((connectionId, groupName));
+
+            return Task.CompletedTask;
+        }
+
+        /// <inheritdoc />
+        public Task RemoveFromGroupAsync(
+            string connectionId,
+            string groupName,
+            CancellationToken cancellationToken = default) => Task.CompletedTask;
+    }
+
+    private sealed class StubHubCallerContext(string connectionId, ClaimsPrincipal user) : HubCallerContext
+    {
+        /// <inheritdoc />
+        public override string ConnectionId { get; } = connectionId;
+
+        /// <inheritdoc />
+        public override string? UserIdentifier => User?.Identity?.Name;
+
+        /// <inheritdoc />
+        public override ClaimsPrincipal? User { get; } = user;
+
+        /// <inheritdoc />
+        public override IDictionary<object, object?> Items { get; } = new Dictionary<object, object?>();
+
+        /// <inheritdoc />
+        public override IFeatureCollection Features { get; } = new FeatureCollection();
+
+        /// <inheritdoc />
+        public override CancellationToken ConnectionAborted => CancellationToken.None;
+
+        /// <inheritdoc />
+        public override void Abort()
+        {
+            // Nothing to abort in a unit-constructed context.
+        }
+    }
+}
@@ -1,5 +1,7 @@
 using System.Security.Claims;
 using Microsoft.AspNetCore.DataProtection;
+using Microsoft.Extensions.Options;
+using ZB.MOM.WW.MxGateway.Server.Configuration;
 using ZB.MOM.WW.MxGateway.Server.Dashboard;

 namespace ZB.MOM.WW.MxGateway.Tests.Gateway.Dashboard;
@@ -19,7 +21,7 @@ public sealed class HubTokenServiceTests
    [Fact]
    public void Validate_TokenWithNullNameAndNullNameIdentifier_ReturnsNull()
    {
-        HubTokenService service = new(new EphemeralDataProtectionProvider());
+        HubTokenService service = CreateService();

        // Issue from a principal with NO Name claim and NO NameIdentifier
        // claim. The Issue method's payload will then carry
@@ -43,7 +45,7 @@ public sealed class HubTokenServiceTests
    [Fact]
    public void Validate_TokenWithName_ReturnsAuthenticatedPrincipal()
    {
-        HubTokenService service = new(new EphemeralDataProtectionProvider());
+        HubTokenService service = CreateService();

        ClaimsIdentity identity = new(
            [
@@ -72,7 +74,7 @@ public sealed class HubTokenServiceTests
    [Fact]
    public void Validate_TokenWithOnlyNameIdentifier_ReturnsPrincipal()
    {
-        HubTokenService service = new(new EphemeralDataProtectionProvider());
+        HubTokenService service = CreateService();

        ClaimsIdentity identity = new(
            [
@@ -93,7 +95,7 @@ public sealed class HubTokenServiceTests
    [Fact]
    public void Validate_NullToken_ReturnsNull()
    {
-        HubTokenService service = new(new EphemeralDataProtectionProvider());
+        HubTokenService service = CreateService();

        Assert.Null(service.Validate(null));
    }
@@ -102,7 +104,7 @@ public sealed class HubTokenServiceTests
    [Fact]
    public void Validate_EmptyToken_ReturnsNull()
    {
-        HubTokenService service = new(new EphemeralDataProtectionProvider());
+        HubTokenService service = CreateService();

        Assert.Null(service.Validate(string.Empty));
    }
@@ -111,7 +113,7 @@ public sealed class HubTokenServiceTests
    [Fact]
    public void Validate_GarbageToken_ReturnsNull()
    {
-        HubTokenService service = new(new EphemeralDataProtectionProvider());
+        HubTokenService service = CreateService();

        Assert.Null(service.Validate("this-is-not-a-protected-payload"));
    }
@@ -123,7 +125,7 @@ public sealed class HubTokenServiceTests
    [Fact]
    public void IssueThenValidate_FreshToken_RoundTripsIdentityAndRoles()
    {
-        HubTokenService service = new(new EphemeralDataProtectionProvider());
+        HubTokenService service = CreateService();
        ClaimsIdentity identity = new(
            [
                new Claim(ClaimTypes.Name, "bob"),
@@ -163,7 +165,7 @@ public sealed class HubTokenServiceTests
    [Fact]
    public void Validate_ExpiredToken_ReturnsNull()
    {
-        HubTokenService service = new(new EphemeralDataProtectionProvider());
+        HubTokenService service = CreateService();
        ClaimsIdentity identity = new(
            [new Claim(ClaimTypes.Name, "carol")],
            authenticationType: "test");
@@ -174,4 +176,85 @@ public sealed class HubTokenServiceTests

        Assert.Null(service.Validate(expiredToken));
    }
+
+    /// <summary>
+    /// The dashboard visibility grant (SEC-25) survives the mint/validate round-trip: tags are
+    /// resolved from the caller's LDAP-group claims through <c>Dashboard:GroupToTag</c> at
+    /// <see cref="HubTokenService.Issue(ClaimsPrincipal)"/> and rehydrated as
+    /// <see cref="DashboardAuthenticationDefaults.DashboardTagClaimType"/> claims on the principal
+    /// <see cref="HubTokenService.Validate"/> reconstructs — which is the principal
+    /// <c>IDashboardSessionAcl</c> reads on the hub path.
+    /// </summary>
+    [Fact]
+    public void IssueThenValidate_ResolvesAndRoundTripsGrantedTags()
+    {
+        HubTokenService service = CreateService(new Dictionary<string, string[]>(StringComparer.OrdinalIgnoreCase)
+        {
+            ["GwViewer"] = ["team-a"],
+            ["TeamBViewers"] = ["team-b"],
+        });
+
+        ClaimsIdentity identity = new(
+            [
+                new Claim(ClaimTypes.Name, "dana"),
+                new Claim(ClaimTypes.Role, DashboardRoles.Viewer),
+                new Claim(DashboardAuthenticationDefaults.LdapGroupClaimType, "GwViewer"),
+                new Claim(DashboardAuthenticationDefaults.LdapGroupClaimType, "TeamBViewers"),
+            ],
+            authenticationType: "test",
+            nameType: ClaimTypes.Name,
+            roleType: ClaimTypes.Role);
+
+        ClaimsPrincipal? result = service.Validate(service.Issue(new ClaimsPrincipal(identity)));
+
+        Assert.NotNull(result);
+        Assert.Equal(
+            ["team-a", "team-b"],
+            result.FindAll(DashboardAuthenticationDefaults.DashboardTagClaimType)
+                .Select(c => c.Value)
+                .Order(StringComparer.Ordinal));
+    }
+
+    /// <summary>
+    /// A caller whose groups map to nothing mints a token with no tags, and validating it yields a
+    /// principal carrying no tag claims — the empty grant the ACL denies tagged sessions on. This
+    /// is also the shape of every token minted before the tag field existed (the payload field
+    /// deserializes to null), so the fail-closed direction is covered for both.
+    /// </summary>
+    [Fact]
+    public void IssueThenValidate_WithNoMatchingGroups_ProducesEmptyGrant()
+    {
+        HubTokenService service = CreateService(new Dictionary<string, string[]>(StringComparer.OrdinalIgnoreCase)
+        {
+            ["SomeOtherGroup"] = ["team-a"],
+        });
+
+        ClaimsIdentity identity = new(
+            [
+                new Claim(ClaimTypes.Name, "erin"),
+                new Claim(ClaimTypes.Role, DashboardRoles.Viewer),
+                new Claim(DashboardAuthenticationDefaults.LdapGroupClaimType, "GwViewer"),
+            ],
+            authenticationType: "test",
+            nameType: ClaimTypes.Name,
+            roleType: ClaimTypes.Role);
+
+        ClaimsPrincipal? result = service.Validate(service.Issue(new ClaimsPrincipal(identity)));
+
+        Assert.NotNull(result);
+        Assert.Empty(result.FindAll(DashboardAuthenticationDefaults.DashboardTagClaimType));
+    }
+
+    private static HubTokenService CreateService(Dictionary<string, string[]>? groupToTag = null)
+    {
+        GatewayOptions options = new()
+        {
+            Dashboard = new DashboardOptions
+            {
+                GroupToTag = groupToTag ?? new Dictionary<string, string[]>(StringComparer.OrdinalIgnoreCase),
+            },
+        };
+
+        return new HubTokenService(new EphemeralDataProtectionProvider(), Options.Create(options));
+    }
 }
@@ -0,0 +1,218 @@
+using System.Runtime.CompilerServices;
+using System.Security.Claims;
+using System.Threading.Channels;
+using Microsoft.AspNetCore.Components;
+using Microsoft.AspNetCore.Components.Authorization;
+using Microsoft.AspNetCore.Components.Web;
+using Microsoft.AspNetCore.Components.Web.HtmlRendering;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using ZB.MOM.WW.MxGateway.Contracts.Proto;
+using ZB.MOM.WW.MxGateway.Server.Dashboard;
+using ZB.MOM.WW.MxGateway.Server.Dashboard.Components.Pages;
+using ZB.MOM.WW.MxGateway.Server.Dashboard.Hubs;
+
+namespace ZB.MOM.WW.MxGateway.Tests.Gateway.Dashboard;
+
+/// <summary>
+/// Covers the ACL gate on the session-details page's in-process subscribe seam (SEC-25 / TST-15).
+/// </summary>
+/// <remarks>
+/// <para>
+/// The 2026-08 in-process feed refactor gave the dashboard a second way to subscribe to a
+/// session's events — <see cref="IDashboardSessionEventSubscriber"/>, used by this page — so
+/// gating the hub join alone would leave the page as an ungated path to the same feed. The
+/// denial assertion here is the one that proves the second seam is closed: it asserts that
+/// <see cref="IDashboardSessionEventSubscriber.Subscribe"/> is never called, not merely that the
+/// panel renders differently.
+/// </para>
+/// <para>
+/// Rendered through the framework's static <see cref="HtmlRenderer"/>, the same idiom
+/// <c>SecretsNavRenderTests</c> uses — no component-testing package, because the assertions are
+/// about the emitted markup and the calls the lifecycle makes, not about interactivity.
+/// </para>
+/// </remarks>
+public sealed class SessionDetailsPageEventAclTests
+{
+    private const string SessionId = "session-1";
+    // Matched without the trailing possessive so the assertion does not depend on how the
+    // renderer escapes the apostrophe.
+    private const string DeniedMessage = "Not authorized for this session";
+    private const string WaitingMarker = "Waiting for events.";
+
+    /// <summary>A denied caller gets the message and no subscription is opened.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
+    [Fact]
+    public async Task Page_WhenAclDenies_RendersMessageAndDoesNotSubscribe()
+    {
+        RecordingEventSubscriber subscriber = new();
+
+        string html = await RenderAsync(subscriber, allow: false);
+
+        Assert.Contains(DeniedMessage, html, StringComparison.Ordinal);
+        Assert.DoesNotContain(WaitingMarker, html, StringComparison.Ordinal);
+        Assert.Empty(subscriber.SubscribedSessionIds);
+    }
+
+    /// <summary>
+    /// The control for the denial above: an allowed caller subscribes and sees the ordinary
+    /// waiting state. Without this, a page that failed to render its events panel at all would
+    /// satisfy the "no subscription" assertion and the suite would report a working gate over a
+    /// broken panel.
+    /// </summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
+    [Fact]
+    public async Task Page_WhenAclAllows_SubscribesAndRendersWaitingState()
+    {
+        RecordingEventSubscriber subscriber = new();
+
+        string html = await RenderAsync(subscriber, allow: true);
+
+        Assert.Equal([SessionId], subscriber.SubscribedSessionIds);
+        Assert.Contains(WaitingMarker, html, StringComparison.Ordinal);
+        Assert.DoesNotContain(DeniedMessage, html, StringComparison.Ordinal);
+    }
+
+    private static async Task<string> RenderAsync(RecordingEventSubscriber subscriber, bool allow)
+    {
+        ServiceCollection services = new();
+        services.AddLogging();
+        services.AddSingleton<IDashboardSnapshotService>(new StubSnapshotService());
+        services.AddSingleton<IDashboardSnapshotFeed>(new IdleSnapshotFeed());
+        services.AddSingleton<IDashboardSessionAdminService>(new NonManagingSessionAdminService());
+        services.AddSingleton<IDashboardSessionEventSubscriber>(subscriber);
+        services.AddSingleton<IDashboardSessionAcl>(new StubSessionAcl(allow));
+        services.AddSingleton<AuthenticationStateProvider>(new StubAuthenticationStateProvider());
+
+        await using ServiceProvider provider = services.BuildServiceProvider();
+        await using HtmlRenderer renderer = new(provider, provider.GetRequiredService<ILoggerFactory>());
+
+        return await renderer.Dispatcher.InvokeAsync(async () =>
+        {
+            HtmlRootComponent output = await renderer.RenderComponentAsync<SessionDetailsPage>(
+                ParameterView.FromDictionary(new Dictionary<string, object?>
+                {
+                    [nameof(SessionDetailsPage.SessionId)] = SessionId,
+                }));
+
+            return output.ToHtmlString();
+        });
+    }
+
+    private sealed class StubSessionAcl(bool allow) : IDashboardSessionAcl
+    {
+        /// <inheritdoc />
+        public bool CanViewSession(ClaimsPrincipal? principal, string sessionId) => allow;
+    }
+
+    private sealed class RecordingEventSubscriber : IDashboardSessionEventSubscriber
+    {
+        /// <summary>Gets the session ids <see cref="Subscribe"/> was called with, in order.</summary>
+        public List<string> SubscribedSessionIds { get; } = [];
+
+        /// <inheritdoc />
+        public IDashboardEventSubscription Subscribe(string sessionId)
+        {
+            SubscribedSessionIds.Add(sessionId);
+
+            return new IdleSubscription();
+        }
+
+        // A subscription whose channel never yields and never completes, so the page's pump parks
+        // exactly as it would against a quiet session.
+        private sealed class IdleSubscription : IDashboardEventSubscription
+        {
+            private readonly Channel<MxEvent> _channel = Channel.CreateUnbounded<MxEvent>();
+
+            /// <inheritdoc />
+            public ChannelReader<MxEvent> Reader => _channel.Reader;
+
+            /// <inheritdoc />
+            public void Dispose() => _channel.Writer.TryComplete();
+        }
+    }
+
+    private sealed class StubSnapshotService : IDashboardSnapshotService
+    {
+        /// <inheritdoc />
+        public DashboardSnapshot GetSnapshot() => new(
+            GeneratedAt: DateTimeOffset.UnixEpoch,
+            GatewayStartedAt: DateTimeOffset.UnixEpoch,
+            GatewayUptime: TimeSpan.Zero,
+            GatewayStatus: "Healthy",
+            GatewayVersion: "test",
+            Sessions:
+            [
+                new DashboardSessionSummary(
+                    SessionId: SessionId,
+                    BackendName: "backend",
+                    State: SessionState.Ready,
+                    ClientIdentity: "client",
+                    ClientSessionName: "client-session",
+                    ClientCorrelationId: "correlation",
+                    OpenedAt: DateTimeOffset.UnixEpoch,
+                    LastClientActivityAt: DateTimeOffset.UnixEpoch,
+                    LeaseExpiresAt: null,
+                    WorkerProcessId: null,
+                    WorkerState: null,
+                    LastWorkerHeartbeatAt: null,
+                    EventsReceived: 0,
+                    LastFault: null),
+            ],
+            Workers: [],
+            Metrics: [],
+            Faults: [],
+            ApiKeys: [],
+            Configuration: null!,
+            Galaxy: null!);
+
+        /// <inheritdoc />
+        public IAsyncEnumerable<DashboardSnapshot> WatchSnapshotsAsync(CancellationToken cancellationToken) =>
+            new IdleSnapshotFeed().WatchAsync(cancellationToken);
+    }
+
+    // Parks until the page is disposed, so the base page's watch loop neither spins nor pushes a
+    // second snapshot mid-assertion.
+    private sealed class IdleSnapshotFeed : IDashboardSnapshotFeed
+    {
+        /// <inheritdoc />
+        public async IAsyncEnumerable<DashboardSnapshot> WatchAsync(
+            [EnumeratorCancellation] CancellationToken cancellationToken)
+        {
+            await Task.Delay(Timeout.Infinite, cancellationToken).ConfigureAwait(false);
+
+            yield break;
+        }
+    }
+
+    private sealed class NonManagingSessionAdminService : IDashboardSessionAdminService
+    {
+        /// <inheritdoc />
+        public bool CanManage(ClaimsPrincipal user) => false;
+
+        /// <inheritdoc />
+        public Task<DashboardSessionAdminResult> CloseSessionAsync(
+            ClaimsPrincipal user,
+            string sessionId,
+            CancellationToken cancellationToken) =>
+            Task.FromResult(DashboardSessionAdminResult.Fail("not supported"));
+
+        /// <inheritdoc />
+        public Task<DashboardSessionAdminResult> KillWorkerAsync(
+            ClaimsPrincipal user,
+            string sessionId,
+            CancellationToken cancellationToken) =>
+            Task.FromResult(DashboardSessionAdminResult.Fail("not supported"));
+    }
+
+    private sealed class StubAuthenticationStateProvider : AuthenticationStateProvider
+    {
+        /// <inheritdoc />
+        public override Task<AuthenticationState> GetAuthenticationStateAsync() =>
+            Task.FromResult(new AuthenticationState(new ClaimsPrincipal(new ClaimsIdentity(
+                [new Claim(ClaimTypes.Name, "viewer-user"), new Claim(ClaimTypes.Role, DashboardRoles.Viewer)],
+                authenticationType: "test",
+                nameType: ClaimTypes.Name,
+                roleType: ClaimTypes.Role))));
+    }
+}