Merge origin/main with local pending work and update AGENTS.md references

- Resolve 14 conflicts from popping local stash on top of origin's
  eed1e88 + 8d3352f doc-comment additions (11 mechanical, plus
  version.rs, DashboardAuthenticatorTests.cs, DashboardGalaxyProjector.cs)
- Fix 4 test files that used AGENTS.md as the repo-root sentinel
  (now use CLAUDE.md, since AGENTS.md was removed in 4731ab5)
- Redirect 10 doc citations from AGENTS.md to the matching gateway.md
  sections (Value Model, Status Model, Security, STA Worker Thread
  Model, gRPC Layer rule, cancellation rule)

Verified: solution build clean, x86 worker build clean, 266/266
gateway tests passing, 121/121 worker tests passing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/MxGateway.Server/Dashboard/Components/Layout/DashboardLayout.razor

@@ -26,14 +26,27 @@
                     <li class="nav-item">
                         <NavLink class="nav-link" href="galaxy">Galaxy</NavLink>
                     </li>
+                    <li class="nav-item">
+                        <NavLink class="nav-link" href="apikeys">API Keys</NavLink>
+                    </li>
                     <li class="nav-item">
                         <NavLink class="nav-link" href="settings">Settings</NavLink>
                     </li>
                 </ul>
-                <form method="post" action="@DashboardPath("/logout")" class="d-flex">
-                    <AntiforgeryToken />
-                    <button class="btn btn-outline-secondary btn-sm" type="submit">Sign out</button>
-                </form>
+                <AuthorizeView>
+                    <Authorized Context="authState">
+                        <div class="d-flex align-items-center gap-2">
+                            <span class="navbar-text">@authState.User.Identity?.Name</span>
+                            <form method="post" action="@DashboardPath("/logout")">
+                                <AntiforgeryToken />
+                                <button class="btn btn-outline-secondary btn-sm" type="submit">Sign out</button>
+                            </form>
+                        </div>
+                    </Authorized>
+                    <NotAuthorized>
+                        <a class="btn btn-outline-secondary btn-sm" href="@DashboardPath("/login")">Sign in</a>
+                    </NotAuthorized>
+                </AuthorizeView>
             </div>
         </div>
     </nav>

src/MxGateway.Server/Dashboard/Components/Pages/GalaxyPage.razor

@@ -190,6 +190,8 @@ else
 
     private int CommandTimeoutSeconds() => GalaxyOptions.Value.CommandTimeoutSeconds;
 
-    private string? GalaxyConnectionStringDisplay() =>
-        DashboardRedactor.Redact(GalaxyOptions.Value.ConnectionString);
+    private string GalaxyConnectionStringDisplay()
+    {
+        return DashboardConnectionStringDisplay.GalaxyRepositoryConnectionString(GalaxyOptions.Value.ConnectionString);
+    }
 }

src/MxGateway.Server/Dashboard/Components/Pages/SettingsPage.razor

@@ -25,6 +25,15 @@ else
                     <tr><th scope="row">Auth database</th><td><code>@Snapshot.Configuration.Authentication.SqlitePath</code></td></tr>
                     <tr><th scope="row">Pepper secret</th><td>@Snapshot.Configuration.Authentication.PepperSecretName</td></tr>
                     <tr><th scope="row">Run migrations</th><td>@Snapshot.Configuration.Authentication.RunMigrationsOnStartup</td></tr>
+                    <tr><th scope="row">LDAP enabled</th><td>@Snapshot.Configuration.Ldap.Enabled</td></tr>
+                    <tr><th scope="row">LDAP server</th><td>@Snapshot.Configuration.Ldap.Server:@Snapshot.Configuration.Ldap.Port</td></tr>
+                    <tr><th scope="row">LDAP TLS</th><td>@Snapshot.Configuration.Ldap.UseTls</td></tr>
+                    <tr><th scope="row">LDAP search base</th><td><code>@Snapshot.Configuration.Ldap.SearchBase</code></td></tr>
+                    <tr><th scope="row">LDAP service account</th><td><code>@Snapshot.Configuration.Ldap.ServiceAccountDn</code></td></tr>
+                    <tr><th scope="row">LDAP service password</th><td>@Snapshot.Configuration.Ldap.ServiceAccountPassword</td></tr>
+                    <tr><th scope="row">LDAP username attribute</th><td>@Snapshot.Configuration.Ldap.UserNameAttribute</td></tr>
+                    <tr><th scope="row">LDAP group attribute</th><td>@Snapshot.Configuration.Ldap.GroupAttribute</td></tr>
+                    <tr><th scope="row">LDAP required group</th><td>@Snapshot.Configuration.Ldap.RequiredGroup</td></tr>
                     <tr><th scope="row">Worker executable</th><td><code>@Snapshot.Configuration.Worker.ExecutablePath</code></td></tr>
                     <tr><th scope="row">Worker architecture</th><td>@Snapshot.Configuration.Worker.RequiredArchitecture</td></tr>
                     <tr><th scope="row">Startup timeout</th><td>@Snapshot.Configuration.Worker.StartupTimeoutSeconds seconds</td></tr>

src/MxGateway.Server/Dashboard/Components/_Imports.razor

@@ -8,5 +8,6 @@
 @using MxGateway.Server.Dashboard
 @using MxGateway.Server.Dashboard.Components.Layout
 @using MxGateway.Server.Dashboard.Components.Shared
+@using MxGateway.Server.Security.Authorization
 @using MxGateway.Server.Workers
 @using static Microsoft.AspNetCore.Components.Web.RenderMode

src/MxGateway.Server/Dashboard/DashboardAuthenticationDefaults.cs

@@ -5,6 +5,7 @@ public static class DashboardAuthenticationDefaults
     public const string AuthenticationScheme = "MxGateway.Dashboard";
     public const string AuthorizationPolicy = "MxGateway.Dashboard";
     public const string ScopeClaimType = "scope";
+    public const string LdapGroupClaimType = "mxgateway:ldap_group";
     public const string KeyPrefixClaimType = "mxgateway:key_prefix";
     public const string CookieName = "__Host-MxGatewayDashboard";
 }

src/MxGateway.Server/Dashboard/DashboardAuthenticator.cs

@@ -1,81 +1,258 @@
 using System.Security.Claims;
+using System.Text;
 using Microsoft.Extensions.Options;
 using MxGateway.Server.Configuration;
-using MxGateway.Server.Security.Authentication;
-using MxGateway.Server.Security.Authorization;
+using Novell.Directory.Ldap;
 
 namespace MxGateway.Server.Dashboard;
 
 public sealed class DashboardAuthenticator(
-    IApiKeyVerifier apiKeyVerifier,
-    IOptions<GatewayOptions> options) : IDashboardAuthenticator
+    IOptions<GatewayOptions> options,
+    ILogger<DashboardAuthenticator> logger) : IDashboardAuthenticator
 {
-    private const string GenericFailureMessage = "The API key is invalid or is not authorized for dashboard access.";
+    private const string GenericFailureMessage = "The username or password is invalid, or the user is not authorized.";
 
     /// <inheritdoc />
     public async Task<DashboardAuthenticationResult> AuthenticateAsync(
-        string? apiKey,
+        string? username,
+        string? password,
         CancellationToken cancellationToken)
     {
-        if (options.Value.Authentication.Mode == AuthenticationMode.Disabled)
-        {
-            return DashboardAuthenticationResult.Success(CreatePrincipal(new ApiKeyIdentity(
-                KeyId: "authentication-disabled",
-                KeyPrefix: "authentication-disabled",
-                DisplayName: "Authentication Disabled",
-                Scopes: new HashSet<string>([GatewayScopes.Admin], StringComparer.Ordinal))));
-        }
-
-        if (string.IsNullOrWhiteSpace(apiKey))
+        LdapOptions ldapOptions = options.Value.Ldap;
+        if (!ldapOptions.Enabled
+            || string.IsNullOrWhiteSpace(username)
+            || string.IsNullOrWhiteSpace(password))
         {
             return DashboardAuthenticationResult.Fail(GenericFailureMessage);
         }
 
-        ApiKeyVerificationResult verificationResult = await apiKeyVerifier
-            .VerifyAsync(FormatAuthorizationHeader(apiKey), cancellationToken)
+        if (!ldapOptions.UseTls && !ldapOptions.AllowInsecureLdap)
+        {
+            return DashboardAuthenticationResult.Fail(GenericFailureMessage);
+        }
+
+        string normalizedUsername = username.Trim();
+
+        try
+        {
+            using LdapConnection connection = new();
+            connection.SecureSocketLayer = ldapOptions.UseTls;
+
+            await Task.Run(
+                    () => connection.Connect(ldapOptions.Server, ldapOptions.Port),
+                    cancellationToken)
+                .ConfigureAwait(false);
+
+            await BindServiceAccountAsync(connection, ldapOptions, cancellationToken).ConfigureAwait(false);
+            LdapEntry? candidate = await SearchUserAsync(
+                    connection,
+                    ldapOptions,
+                    normalizedUsername,
+                    cancellationToken)
+                .ConfigureAwait(false);
+
+            if (candidate is null)
+            {
+                return DashboardAuthenticationResult.Fail(GenericFailureMessage);
+            }
+
+            await Task.Run(
+                    () => connection.Bind(candidate.Dn, password),
+                    cancellationToken)
+                .ConfigureAwait(false);
+
+            await BindServiceAccountAsync(connection, ldapOptions, cancellationToken).ConfigureAwait(false);
+            LdapEntry? authenticatedEntry = await SearchUserAsync(
+                    connection,
+                    ldapOptions,
+                    normalizedUsername,
+                    cancellationToken)
+                .ConfigureAwait(false);
+
+            if (authenticatedEntry is null)
+            {
+                return DashboardAuthenticationResult.Fail(GenericFailureMessage);
+            }
+
+            string displayName = ReadAttribute(authenticatedEntry, ldapOptions.DisplayNameAttribute)
+                ?? normalizedUsername;
+            IReadOnlyList<string> groups = ReadAttributeValues(authenticatedEntry, ldapOptions.GroupAttribute);
+
+            if (!IsMemberOfRequiredGroup(groups, ldapOptions.RequiredGroup))
+            {
+                logger.LogInformation(
+                    "LDAP dashboard login denied for user {User}: missing required group {RequiredGroup}.",
+                    normalizedUsername,
+                    ldapOptions.RequiredGroup);
+
+                return DashboardAuthenticationResult.Fail(GenericFailureMessage);
+            }
+
+            return DashboardAuthenticationResult.Success(CreatePrincipal(
+                normalizedUsername,
+                displayName,
+                groups));
+        }
+        catch (OperationCanceledException)
+        {
+            throw;
+        }
+        catch (LdapException ex)
+        {
+            logger.LogInformation(
+                "LDAP dashboard login rejected for user {User}: result code {ResultCode}.",
+                normalizedUsername,
+                ex.ResultCode);
+
+            return DashboardAuthenticationResult.Fail(GenericFailureMessage);
+        }
+        catch (Exception ex)
+        {
+            logger.LogError(ex, "Unexpected LDAP dashboard login error for user {User}.", normalizedUsername);
+
+            return DashboardAuthenticationResult.Fail(GenericFailureMessage);
+        }
+    }
+
+    internal static string EscapeLdapFilter(string value)
+    {
+        StringBuilder builder = new(value.Length);
+        foreach (char character in value)
+        {
+            builder.Append(character switch
+            {
+                '\\' => @"\5c",
+                '*' => @"\2a",
+                '(' => @"\28",
+                ')' => @"\29",
+                '\0' => @"\00",
+                _ => character.ToString()
+            });
+        }
+
+        return builder.ToString();
+    }
+
+    internal static bool IsMemberOfRequiredGroup(IEnumerable<string> groups, string requiredGroup)
+    {
+        string normalizedRequiredGroup = requiredGroup.Trim();
+        if (string.IsNullOrWhiteSpace(normalizedRequiredGroup))
+        {
+            return false;
+        }
+
+        foreach (string group in groups)
+        {
+            string normalizedGroup = group.Trim();
+            if (string.Equals(normalizedGroup, normalizedRequiredGroup, StringComparison.OrdinalIgnoreCase)
+                || string.Equals(
+                    ExtractFirstRdnValue(normalizedGroup),
+                    normalizedRequiredGroup,
+                    StringComparison.OrdinalIgnoreCase))
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    internal static string ExtractFirstRdnValue(string distinguishedName)
+    {
+        int equalsIndex = distinguishedName.IndexOf('=');
+        if (equalsIndex < 0)
+        {
+            return distinguishedName;
+        }
+
+        int valueStart = equalsIndex + 1;
+        int commaIndex = distinguishedName.IndexOf(',', valueStart);
+
+        return commaIndex > valueStart
+            ? distinguishedName[valueStart..commaIndex]
+            : distinguishedName[valueStart..];
+    }
+
+    private static Task BindServiceAccountAsync(
+        LdapConnection connection,
+        LdapOptions ldapOptions,
+        CancellationToken cancellationToken)
+    {
+        return Task.Run(
+            () => connection.Bind(ldapOptions.ServiceAccountDn, ldapOptions.ServiceAccountPassword),
+            cancellationToken);
+    }
+
+    private static async Task<LdapEntry?> SearchUserAsync(
+        LdapConnection connection,
+        LdapOptions ldapOptions,
+        string username,
+        CancellationToken cancellationToken)
+    {
+        string filter = $"({ldapOptions.UserNameAttribute}={EscapeLdapFilter(username)})";
+        ILdapSearchResults results = await Task.Run(
+                () => connection.Search(
+                    ldapOptions.SearchBase,
+                    LdapConnection.ScopeSub,
+                    filter,
+                    attrs: null,
+                    typesOnly: false),
+                cancellationToken)
             .ConfigureAwait(false);
 
-        if (!verificationResult.Succeeded || verificationResult.Identity is null)
+        LdapEntry? entry = null;
+        while (results.HasMore())
         {
-            return DashboardAuthenticationResult.Fail(GenericFailureMessage);
+            LdapEntry next = results.Next();
+            if (entry is not null)
+            {
+                return null;
+            }
+
+            entry = next;
         }
 
-        if (options.Value.Dashboard.RequireAdminScope
-            && !verificationResult.Identity.Scopes.Contains(GatewayScopes.Admin))
-        {
-            return DashboardAuthenticationResult.Fail(GenericFailureMessage);
-        }
-
-        return DashboardAuthenticationResult.Success(CreatePrincipal(verificationResult.Identity));
+        return entry;
     }
 
-    private static string FormatAuthorizationHeader(string apiKey)
+    private static string? ReadAttribute(LdapEntry entry, string attributeName)
     {
-        string trimmedApiKey = apiKey.Trim();
-
-        return trimmedApiKey.StartsWith("Bearer ", StringComparison.OrdinalIgnoreCase)
-            ? trimmedApiKey
-            : $"Bearer {trimmedApiKey}";
+        return ReadLdapAttribute(entry, attributeName)?.StringValue;
     }
 
-    private static ClaimsPrincipal CreatePrincipal(ApiKeyIdentity identity)
+    private static IReadOnlyList<string> ReadAttributeValues(LdapEntry entry, string attributeName)
+    {
+        LdapAttribute? attribute = ReadLdapAttribute(entry, attributeName);
+        return attribute?.StringValueArray ?? [];
+    }
+
+    private static LdapAttribute? ReadLdapAttribute(LdapEntry entry, string attributeName)
+    {
+        return entry.GetAttribute(attributeName)
+            ?? entry.GetAttribute(attributeName.ToLowerInvariant())
+            ?? entry.GetAttribute(attributeName.ToUpperInvariant());
+    }
+
+    private static ClaimsPrincipal CreatePrincipal(
+        string username,
+        string displayName,
+        IEnumerable<string> groups)
     {
         List<Claim> claims =
         [
-            new Claim(ClaimTypes.NameIdentifier, identity.KeyId),
-            new Claim(ClaimTypes.Name, identity.DisplayName),
-            new Claim(DashboardAuthenticationDefaults.KeyPrefixClaimType, identity.KeyPrefix)
+            new Claim(ClaimTypes.NameIdentifier, username),
+            new Claim(ClaimTypes.Name, displayName)
         ];
 
-        claims.AddRange(identity.Scopes.Select(scope => new Claim(
-            DashboardAuthenticationDefaults.ScopeClaimType,
-            scope)));
+        claims.AddRange(groups.Select(group => new Claim(
+            DashboardAuthenticationDefaults.LdapGroupClaimType,
+            group)));
 
         ClaimsIdentity claimsIdentity = new(
             claims,
             DashboardAuthenticationDefaults.AuthenticationScheme,
             ClaimTypes.Name,
-            DashboardAuthenticationDefaults.ScopeClaimType);
+            DashboardAuthenticationDefaults.LdapGroupClaimType);
 
         return new ClaimsPrincipal(claimsIdentity);
     }

src/MxGateway.Server/Dashboard/DashboardEndpointRouteBuilderExtensions.cs

@@ -43,18 +43,17 @@ public static class DashboardEndpointRouteBuilderExtensions
         dashboard.MapPost(
                 "/logout",
                 (HttpContext httpContext, IAntiforgery antiforgery) => PostLogoutAsync(httpContext, antiforgery, pathBase))
-            .RequireAuthorization(DashboardAuthenticationDefaults.AuthorizationPolicy)
+            .AllowAnonymous()
             .WithName("DashboardLogout");
 
         dashboard.MapGet("/denied", () => Results.Content(
-                RenderPage("Access denied", "<p>The signed-in API key is not authorized for dashboard access.</p>"),
+                RenderPage("Access denied", "<p>The signed-in user is not authorized for dashboard access.</p>"),
                 "text/html"))
             .AllowAnonymous()
             .WithName("DashboardAccessDenied");
 
         dashboard.MapRazorComponents<App>()
-            .AddInteractiveServerRenderMode()
-            .RequireAuthorization(DashboardAuthenticationDefaults.AuthorizationPolicy);
+            .AddInteractiveServerRenderMode();
 
         return endpoints;
     }
@@ -89,7 +88,10 @@ public static class DashboardEndpointRouteBuilderExtensions
             pathBase);
 
         DashboardAuthenticationResult result = await authenticator
-            .AuthenticateAsync(form["apiKey"].ToString(), httpContext.RequestAborted)
+            .AuthenticateAsync(
+                form["username"].ToString(),
+                form["password"].ToString(),
+                httpContext.RequestAborted)
             .ConfigureAwait(false);
 
         if (!result.Succeeded || result.Principal is null)
@@ -131,7 +133,7 @@ public static class DashboardEndpointRouteBuilderExtensions
         string requestToken = tokens.RequestToken ?? string.Empty;
         string alert = string.IsNullOrWhiteSpace(failureMessage)
             ? string.Empty
-            : $"<p role=\"alert\">{HtmlEncoder.Default.Encode(failureMessage)}</p>";
+            : $"<p class=\"alert alert-danger\" role=\"alert\">{HtmlEncoder.Default.Encode(failureMessage)}</p>";
 
         string body = $"""
             <section class="dashboard-login">
@@ -141,8 +143,12 @@ public static class DashboardEndpointRouteBuilderExtensions
                         <input name="{tokens.FormFieldName}" type="hidden" value="{HtmlEncoder.Default.Encode(requestToken)}" />
                         <input name="returnUrl" type="hidden" value="{HtmlEncoder.Default.Encode(returnUrl)}" />
                         <div class="mb-3">
-                            <label for="apiKey" class="form-label">API key</label>
-                            <input id="apiKey" name="apiKey" type="password" autocomplete="off" class="form-control" />
+                            <label for="username" class="form-label">Username</label>
+                            <input id="username" name="username" type="text" autocomplete="username" class="form-control" />
+                        </div>
+                        <div class="mb-3">
+                            <label for="password" class="form-label">Password</label>
+                            <input id="password" name="password" type="password" autocomplete="current-password" class="form-control" />
                         </div>
                         <button type="submit" class="btn btn-primary">Sign in</button>
                     </div>

src/MxGateway.Server/Dashboard/DashboardGalaxyProjector.cs

@@ -2,101 +2,11 @@ using MxGateway.Server.Galaxy;
 
 namespace MxGateway.Server.Dashboard;
 
-/// <summary>
-///     Projects a <see cref="GalaxyHierarchyCacheEntry"/> into a
-///     <see cref="DashboardGalaxySummary"/> for the Blazor pages. Top-templates and
-///     per-category breakdowns are computed here rather than stored on the cache so the
-///     Galaxy namespace stays free of dashboard-presentation concepts.
-/// </summary>
-/// <summary>Projects Galaxy Repository cache entries to dashboard presentation format.</summary>
+/// <summary>Projects the precomputed Galaxy cache dashboard summary.</summary>
 internal static class DashboardGalaxyProjector
 {
-    private const int TopTemplatesLimit = 10;
-
-    private static readonly IReadOnlyDictionary<int, string> CategoryNamesById = new Dictionary<int, string>
-    {
-        [1] = "WinPlatform",
-        [3] = "AppEngine",
-        [4] = "InTouchViewApp",
-        [10] = "UserDefined",
-        [11] = "FieldReference",
-        [13] = "Area",
-        [17] = "DIObject",
-        [24] = "DDESuiteLinkClient",
-        [26] = "OPCClient",
-    };
-
-    /// <summary>Projects a Galaxy Repository cache entry to a dashboard summary.</summary>
-    /// <param name="entry">Galaxy cache entry to project.</param>
-    /// <returns>Dashboard-formatted Galaxy summary.</returns>
     public static DashboardGalaxySummary Project(GalaxyHierarchyCacheEntry entry)
     {
-        DashboardGalaxyStatus status = entry.Status switch
-        {
-            GalaxyCacheStatus.Healthy => DashboardGalaxyStatus.Healthy,
-            GalaxyCacheStatus.Stale => DashboardGalaxyStatus.Stale,
-            GalaxyCacheStatus.Unavailable => DashboardGalaxyStatus.Unavailable,
-            _ => DashboardGalaxyStatus.Unknown,
-        };
-
-        IReadOnlyList<DashboardGalaxyTemplateUsage> topTemplates;
-        IReadOnlyList<DashboardGalaxyCategoryCount> objectCategories;
-
-        if (entry.Hierarchy.Count == 0)
-        {
-            topTemplates = Array.Empty<DashboardGalaxyTemplateUsage>();
-            objectCategories = Array.Empty<DashboardGalaxyCategoryCount>();
-        }
-        else
-        {
-            Dictionary<int, int> objectsByCategory = new();
-            Dictionary<string, int> templateUsage = new(StringComparer.OrdinalIgnoreCase);
-
-            foreach (GalaxyHierarchyRow row in entry.Hierarchy)
-            {
-                objectsByCategory.TryGetValue(row.CategoryId, out int categoryCount);
-                objectsByCategory[row.CategoryId] = categoryCount + 1;
-
-                if (row.TemplateChain.Count > 0)
-                {
-                    string immediate = row.TemplateChain[0];
-                    if (!string.IsNullOrWhiteSpace(immediate))
-                    {
-                        templateUsage.TryGetValue(immediate, out int templateCount);
-                        templateUsage[immediate] = templateCount + 1;
-                    }
-                }
-            }
-
-            topTemplates = templateUsage
-                .OrderByDescending(entry => entry.Value)
-                .ThenBy(entry => entry.Key, StringComparer.OrdinalIgnoreCase)
-                .Take(TopTemplatesLimit)
-                .Select(entry => new DashboardGalaxyTemplateUsage(entry.Key, entry.Value))
-                .ToArray();
-
-            objectCategories = objectsByCategory
-                .OrderByDescending(entry => entry.Value)
-                .ThenBy(entry => entry.Key)
-                .Select(entry => new DashboardGalaxyCategoryCount(
-                    entry.Key,
-                    CategoryNamesById.TryGetValue(entry.Key, out string? name) ? name : $"Category {entry.Key}",
-                    entry.Value))
-                .ToArray();
-        }
-
-        return new DashboardGalaxySummary(
-            Status: status,
-            LastQueriedAt: entry.LastQueriedAt,
-            LastSuccessAt: entry.LastSuccessAt,
-            LastDeployTime: entry.LastDeployTime,
-            LastError: entry.LastError,
-            ObjectCount: entry.ObjectCount,
-            AreaCount: entry.AreaCount,
-            AttributeCount: entry.AttributeCount,
-            HistorizedAttributeCount: entry.HistorizedAttributeCount,
-            AlarmAttributeCount: entry.AlarmAttributeCount,
-            TopTemplates: topTemplates,
-            ObjectCategories: objectCategories);
+        return entry.DashboardSummary;
     }
 }

src/MxGateway.Server/Dashboard/DashboardServiceCollectionExtensions.cs

@@ -18,6 +18,8 @@ public static class DashboardServiceCollectionExtensions
     {
         services.AddSingleton<IDashboardSnapshotService, DashboardSnapshotService>();
         services.AddSingleton<IDashboardAuthenticator, DashboardAuthenticator>();
+        services.AddSingleton<DashboardApiKeyAuthorization>();
+        services.AddSingleton<IDashboardApiKeyManagementService, DashboardApiKeyManagementService>();
         services.AddHttpContextAccessor();
         services.AddAntiforgery();
         services.AddCascadingAuthenticationState();

src/MxGateway.Server/Dashboard/DashboardSnapshot.cs

@@ -12,5 +12,6 @@ public sealed record DashboardSnapshot(
     IReadOnlyList<DashboardWorkerSummary> Workers,
     IReadOnlyList<DashboardMetricSummary> Metrics,
     IReadOnlyList<DashboardFaultSummary> Faults,
+    IReadOnlyList<DashboardApiKeySummary> ApiKeys,
     EffectiveGatewayConfiguration Configuration,
     DashboardGalaxySummary Galaxy);

src/MxGateway.Server/Dashboard/DashboardSnapshotService.cs

@@ -1,8 +1,11 @@
 using System.Runtime.CompilerServices;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Logging.Abstractions;
 using Microsoft.Extensions.Options;
 using MxGateway.Server.Configuration;
 using MxGateway.Server.Galaxy;
 using MxGateway.Server.Metrics;
+using MxGateway.Server.Security.Authentication;
 using MxGateway.Server.Sessions;
 using MxGateway.Server.Workers;
 
@@ -16,11 +19,16 @@ public sealed class DashboardSnapshotService : IDashboardSnapshotService
     private readonly GatewayMetrics _metrics;
     private readonly IGatewayConfigurationProvider _configurationProvider;
     private readonly IGalaxyHierarchyCache _galaxyHierarchyCache;
+    private readonly IApiKeyAdminStore _apiKeyAdminStore;
     private readonly TimeProvider _timeProvider;
     private readonly DateTimeOffset _gatewayStartedAt;
     private readonly TimeSpan _snapshotInterval;
+    private readonly TimeSpan _apiKeySummaryRefreshTimeout = TimeSpan.FromSeconds(2);
     private readonly int _recentFaultLimit;
     private readonly int _recentSessionLimit;
+    private readonly ILogger<DashboardSnapshotService> _logger;
+    private readonly SemaphoreSlim _apiKeySummaryRefreshGate = new(1, 1);
+    private IReadOnlyList<DashboardApiKeySummary> _apiKeySummaries = Array.Empty<DashboardApiKeySummary>();
 
     /// <summary>Initializes a new instance of the DashboardSnapshotService class.</summary>
     /// <param name="sessionRegistry">Registry of active gateway sessions.</param>
@@ -34,13 +42,16 @@ public sealed class DashboardSnapshotService : IDashboardSnapshotService
         GatewayMetrics metrics,
         IGatewayConfigurationProvider configurationProvider,
         IGalaxyHierarchyCache galaxyHierarchyCache,
+        IApiKeyAdminStore apiKeyAdminStore,
         IOptions<GatewayOptions> options,
-        TimeProvider? timeProvider = null)
+        TimeProvider? timeProvider = null,
+        ILogger<DashboardSnapshotService>? logger = null)
     {
         _sessionRegistry = sessionRegistry ?? throw new ArgumentNullException(nameof(sessionRegistry));
         _metrics = metrics ?? throw new ArgumentNullException(nameof(metrics));
         _configurationProvider = configurationProvider ?? throw new ArgumentNullException(nameof(configurationProvider));
         _galaxyHierarchyCache = galaxyHierarchyCache ?? throw new ArgumentNullException(nameof(galaxyHierarchyCache));
+        _apiKeyAdminStore = apiKeyAdminStore ?? throw new ArgumentNullException(nameof(apiKeyAdminStore));
         ArgumentNullException.ThrowIfNull(options);
 
         _timeProvider = timeProvider ?? TimeProvider.System;
@@ -48,6 +59,7 @@ public sealed class DashboardSnapshotService : IDashboardSnapshotService
         _snapshotInterval = TimeSpan.FromMilliseconds(options.Value.Dashboard.SnapshotIntervalMilliseconds);
         _recentFaultLimit = options.Value.Dashboard.RecentFaultLimit;
         _recentSessionLimit = options.Value.Dashboard.RecentSessionLimit;
+        _logger = logger ?? NullLogger<DashboardSnapshotService>.Instance;
     }
 
     /// <summary>
@@ -80,6 +92,7 @@ public sealed class DashboardSnapshotService : IDashboardSnapshotService
             Workers: workerSummaries,
             Metrics: CreateMetricSummaries(metricsSnapshot),
             Faults: CreateFaultSummaries(sessions, generatedAt),
+            ApiKeys: Volatile.Read(ref _apiKeySummaries),
             Configuration: _configurationProvider.GetEffectiveConfiguration(),
             Galaxy: DashboardGalaxyProjector.Project(_galaxyHierarchyCache.Current));
     }
@@ -97,6 +110,7 @@ public sealed class DashboardSnapshotService : IDashboardSnapshotService
             yield break;
         }
 
+        await RefreshApiKeySummariesAsync(cancellationToken).ConfigureAwait(false);
         yield return GetSnapshot();
 
         using PeriodicTimer timer = new(_snapshotInterval, _timeProvider);
@@ -117,6 +131,7 @@ public sealed class DashboardSnapshotService : IDashboardSnapshotService
                 yield break;
             }
 
+            await RefreshApiKeySummariesAsync(cancellationToken).ConfigureAwait(false);
             yield return GetSnapshot();
         }
     }
@@ -208,6 +223,51 @@ public sealed class DashboardSnapshotService : IDashboardSnapshotService
             .ToArray();
     }
 
+    private async Task RefreshApiKeySummariesAsync(CancellationToken cancellationToken)
+    {
+        if (!await _apiKeySummaryRefreshGate.WaitAsync(0, cancellationToken).ConfigureAwait(false))
+        {
+            return;
+        }
+
+        try
+        {
+            using CancellationTokenSource timeout = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
+            timeout.CancelAfter(_apiKeySummaryRefreshTimeout);
+            IReadOnlyList<DashboardApiKeySummary> summaries = (await _apiKeyAdminStore.ListAsync(timeout.Token)
+                    .ConfigureAwait(false))
+                .Select(key => new DashboardApiKeySummary(
+                    KeyId: key.KeyId,
+                    DisplayName: key.DisplayName,
+                    Scopes: key.Scopes,
+                    Constraints: key.Constraints,
+                    CreatedUtc: key.CreatedUtc,
+                    LastUsedUtc: key.LastUsedUtc,
+                    RevokedUtc: key.RevokedUtc))
+                .ToArray();
+
+            Volatile.Write(ref _apiKeySummaries, summaries);
+        }
+        catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested)
+        {
+            throw;
+        }
+        catch (OperationCanceledException)
+        {
+            _logger.LogWarning(
+                "Timed out refreshing dashboard API key summaries after {Timeout}.",
+                _apiKeySummaryRefreshTimeout);
+        }
+        catch (Exception)
+        {
+            _logger.LogWarning("Failed to refresh dashboard API key summaries.");
+        }
+        finally
+        {
+            _apiKeySummaryRefreshGate.Release();
+        }
+    }
+
     private static bool HasFault(GatewaySession session)
     {
         return session.State == MxGateway.Contracts.Proto.SessionState.Faulted

src/MxGateway.Server/Dashboard/IDashboardAuthenticator.cs

@@ -11,6 +11,7 @@ public interface IDashboardAuthenticator
     /// <param name="apiKey">The API key to authenticate.</param>
     /// <param name="cancellationToken">Token to cancel the asynchronous operation.</param>
     Task<DashboardAuthenticationResult> AuthenticateAsync(
-        string? apiKey,
+        string? username,
+        string? password,
         CancellationToken cancellationToken);
 }