From 8257a0333ea22b2240a006d6879a991432f48f69 Mon Sep 17 00:00:00 2001
From: Joseph Doherty <dohejw01@gmail.com>
Date: Thu, 20 Aug 2026 09:30:45 -0400
Subject: [PATCH] docs(SEC-40): correct the hub-mapping comment now that
 AlarmsHub uses its own policy

---
 .../Dashboard/DashboardEndpointRouteBuilderExtensions.cs  | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardEndpointRouteBuilderExtensions.cs b/src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardEndpointRouteBuilderExtensions.cs
index e273726..b0e4c24 100644
--- a/src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardEndpointRouteBuilderExtensions.cs
+++ b/src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardEndpointRouteBuilderExtensions.cs
@@ -104,9 +104,11 @@ public static class DashboardEndpointRouteBuilderExtensions
             .AllowAnonymous()
             .WithName("DashboardAccessDenied");
 
-        // SignalR hubs. Authorization is enforced on the hub class via
-        // [Authorize(Policy = HubClientsPolicy)] so the policy accepts either
-        // the dashboard cookie or a HubToken bearer.
+        // SignalR hubs. Authorization is enforced on the hub class via [Authorize], so both
+        // policies below accept either the dashboard cookie or a HubToken bearer. Snapshot and
+        // events use HubClientsPolicy; AlarmsHub uses AlarmsPolicy, which additionally requires a
+        // real authenticated dashboard role (SEC-40) — see AlarmsHub for why the alarm feed is
+        // gated harder than the session-scoped ones.
         endpoints.MapHub<DashboardSnapshotHub>("/hubs/snapshot");
         endpoints.MapHub<AlarmsHub>("/hubs/alarms");
         endpoints.MapHub<EventsHub>("/hubs/events");