feat(security): DashboardTags on API-key constraints; sessions inherit owner tags (SEC-25 groundwork)

Adds a dashboard event-visibility tag to ApiKeyConstraints, riding in the existing constraints JSON blob so no auth-store schema migration is needed (design docs/plans/2026-07-10-dashboard-session-acl-tst15.md sections 3/3.1, open call settled per its own recommendation). The tag is visibility-only: no read, write, browse, or subscribe path consults it, and HasRead/HasWriteConstraints ignore it. GatewaySession gains an immutable, ordinal-ignore-case Tags set stamped at construction from the owning API key, forwarded by MxAccessGatewayService.OpenSession from the resolved ApiKeyIdentity — never from the wire request, so a client cannot label its own session with another tenant's tag. ISessionManager gains a tag-carrying OpenSessionAsync overload whose default implementation forwards to the tagless one, so an implementation that does not model tags opens an untagged (least visible) session. apikey create-key gains --dashboard-tags team-a,team-b (repeatable, trimmed, de-duplicated; an empty segment is rejected rather than dropped) and list-keys prints the tags column. No enforcement yet — the EventsHub ACL that consumes the tag is a later change.
2026-08-17 03:58:14 -04:00
parent 9130994736
commit a212e145ac
14 changed files with 477 additions and 10 deletions
@@ -109,6 +109,55 @@ public sealed class SessionManagerTests
        Assert.Null(session.OwnerKeyId);
    }

+    /// <summary>
+    ///     Verifies a session inherits the owning API key's dashboard-visibility tags (SEC-25),
+    ///     compared ordinal-ignore-case so a differently cased grant still matches.
+    /// </summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
+    [Fact]
+    public async Task OpenSessionAsync_WithOwnerDashboardTags_CopiesTagsOntoSession()
+    {
+        SessionManager manager = CreateManager(new FakeSessionWorkerClientFactory(new FakeWorkerClient()));
+
+        GatewaySession session = await manager.OpenSessionAsync(
+            CreateOpenRequest(),
+            clientIdentity: "MyKey Display",
+            ownerKeyId: "key-abc123",
+            ownerDashboardTags: ["team-a", "team-b"],
+            CancellationToken.None);
+
+        Assert.Equal(["team-a", "team-b"], session.Tags.OrderBy(tag => tag, StringComparer.Ordinal));
+        Assert.Contains("TEAM-A", session.Tags);
+    }
+
+    /// <summary>
+    ///     Verifies a session opened by a key with no dashboard tags is untagged, which is the
+    ///     fail-closed state for dashboard event visibility.
+    /// </summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
+    [Fact]
+    public async Task OpenSessionAsync_WithoutOwnerDashboardTags_LeavesSessionUntagged()
+    {
+        SessionManager manager = CreateManager(new FakeSessionWorkerClientFactory(new FakeWorkerClient()));
+
+        GatewaySession session = await manager.OpenSessionAsync(
+            CreateOpenRequest(),
+            clientIdentity: "MyKey Display",
+            ownerKeyId: "key-abc123",
+            ownerDashboardTags: null,
+            CancellationToken.None);
+
+        Assert.Empty(session.Tags);
+
+        GatewaySession tagless = await manager.OpenSessionAsync(
+            CreateOpenRequest(),
+            "client-1",
+            ownerKeyId: null,
+            CancellationToken.None);
+
+        Assert.Empty(tagless.Tags);
+    }
+
    /// <summary>Verifies that opening a session sets the initial lease expiry from the configured default lease.</summary>
    /// <returns>A task that represents the asynchronous operation.</returns>
    [Fact]