Joseph Doherty
17f16ea181
SEC-07: add QueryActiveAlarmsRequest -> events:read scope arm; fix two tests that
constructed StreamAlarmsRequest instead of QueryActiveAlarmsRequest.
SEC-05: shorten hub-token lifetime 30m -> 5m; document that the ?access_token= query
carriage must never be request-logged.
SEC-08: gateway-side CachingApiKeyVerifier (short TTL, keyed on a hash of the presented
secret) skips the per-call store read+last_used write; CoalescingMarkApiKeyStore bounds
last_used writes to <=1/key/min; identity constraints are cached. Invalidation is wired
at the gateway admin sites (revoke/rotate/delete); short TTL backstops out-of-process CLI.
SEC-11: fixed-window rate limit on POST /auth/login + a per-peer (key-id) failure limiter
checked before VerifyAsync; new MxGateway:Security options bound + validated.
Also fixes regressions from the SEC-01/04/06 commit (c185f62) that a narrow test filter
missed (all now covered by a full-suite checkpoint):
- Rooting check is cross-platform: accepts Windows C:\/UNC forms on Unix so the shipped
appsettings path validates on the macOS dev box, still rejecting bare filenames.
- AddGatewayConfiguration TryAdds a non-production IHostEnvironment fallback so the validator
resolves in minimal test/tooling containers; the real host + apikey CLI register the actual
environment first (TryAdd no-op there).
- Test assembly defaults ASPNETCORE_ENVIRONMENT=Development (ModuleInitializer) so full-host
tests exercise wiring instead of tripping the SEC-04/06 production guards.
- GatewayOptionsTests asserts the SEC-01 CommonApplicationData-derived default (platform-correct).
archreview: SEC-07/05/08/11 (P1). Verified: NonWindows build clean; full gateway suite
747 passed / 42 failed, where all 42 are the pre-existing macOS named-pipe-harness failures
(Unix-socket path limit) and 0 are validation/regression failures.
56 lines
1.8 KiB
C#
56 lines
1.8 KiB
C#
namespace ZB.MOM.WW.MxGateway.Server.Configuration;
|
|
|
|
public sealed class GatewayOptions
|
|
{
|
|
public const string SectionName = "MxGateway";
|
|
|
|
/// <summary>
|
|
/// Gets authentication configuration options.
|
|
/// </summary>
|
|
public AuthenticationOptions Authentication { get; init; } = new();
|
|
|
|
/// <summary>Gets LDAP configuration options.</summary>
|
|
public LdapOptions Ldap { get; init; } = new();
|
|
|
|
/// <summary>
|
|
/// Gets worker process configuration options.
|
|
/// </summary>
|
|
public WorkerOptions Worker { get; init; } = new();
|
|
|
|
/// <summary>
|
|
/// Gets session management configuration options.
|
|
/// </summary>
|
|
public SessionOptions Sessions { get; init; } = new();
|
|
|
|
/// <summary>
|
|
/// Gets event stream configuration options.
|
|
/// </summary>
|
|
public EventOptions Events { get; init; } = new();
|
|
|
|
/// <summary>
|
|
/// Gets dashboard configuration options.
|
|
/// </summary>
|
|
public DashboardOptions Dashboard { get; init; } = new();
|
|
|
|
/// <summary>
|
|
/// Gets protocol configuration options.
|
|
/// </summary>
|
|
public ProtocolOptions Protocol { get; init; } = new();
|
|
|
|
/// <summary>
|
|
/// Gets alarm-subsystem configuration options. Drives the gateway's
|
|
/// auto-subscribe-on-session-open hook; default values preserve legacy
|
|
/// behaviour (alarms disabled).
|
|
/// </summary>
|
|
public AlarmsOptions Alarms { get; init; } = new();
|
|
|
|
/// <summary>Gets self-signed TLS certificate auto-generation options.</summary>
|
|
public TlsOptions Tls { get; init; } = new();
|
|
|
|
/// <summary>
|
|
/// Gets security hot-path options (API-key verification cache / last-used coalescing and
|
|
/// login / API-key rate limiting).
|
|
/// </summary>
|
|
public SecurityOptions Security { get; init; } = new();
|
|
}
|