Joseph Doherty
f40409a688
Tracking IDs are review bookkeeping that rots in shipped source; the rationale they tagged is kept. Comment-only change (CommentChecker 458 -> 16 false positives).
40 lines
2.3 KiB
C#
40 lines
2.3 KiB
C#
using Microsoft.AspNetCore.Authorization;
|
|
|
|
namespace ZB.MOM.WW.MxGateway.Server.Dashboard;
|
|
|
|
/// <summary>
|
|
/// Requirement satisfied ONLY by an authenticated principal holding one of
|
|
/// <see cref="RequiredRoles"/> as a real role claim. Unlike
|
|
/// <see cref="DashboardAuthorizationRequirement"/> there is no environment bypass: it is a
|
|
/// distinct requirement type, so <see cref="DashboardAuthorizationHandler"/> —
|
|
/// an <c>AuthorizationHandler<DashboardAuthorizationRequirement></c> — is never invoked for
|
|
/// it and its <c>Authentication:Mode=Disabled</c> / anonymous-localhost arms cannot reach it.
|
|
/// The type distinction is the enforcement; adding a bypass arm to the other handler cannot leak
|
|
/// into this one by accident.
|
|
/// </summary>
|
|
/// <remarks>
|
|
/// Introduced to gate the alarm feed (<c>AlarmsHub</c> and the <c>/alarms</c> page),
|
|
/// which is gateway-central and session-less and therefore carries no per-session provenance the
|
|
/// tag ACL could scope it by. Requiring a real dashboard role claim is the narrowing that
|
|
/// is actually available: it keeps galaxy-wide alarm metadata — alarm reference (a full tag path),
|
|
/// state, severity, category, area, acknowledging operator — away from the read-only environment
|
|
/// bypasses, which exist for local development and unauthenticated deployments rather than as a
|
|
/// grant of plant-wide visibility. The same pattern the shared Secrets UI relies on: a policy the
|
|
/// dashboard bypass handler cannot satisfy because the requirement type differs.
|
|
/// </remarks>
|
|
/// <param name="requiredRoles">Roles any one of which satisfies the requirement.</param>
|
|
public sealed class AuthenticatedDashboardRoleRequirement(IReadOnlyList<string> requiredRoles)
|
|
: IAuthorizationRequirement
|
|
{
|
|
/// <summary>Gets the roles, any one of which satisfies this requirement.</summary>
|
|
public IReadOnlyList<string> RequiredRoles { get; } = requiredRoles;
|
|
|
|
/// <summary>
|
|
/// Gets the requirement satisfied by an authenticated caller holding either dashboard role.
|
|
/// Same role set as <see cref="DashboardAuthorizationRequirement.AnyDashboardRole"/>; the
|
|
/// difference is entirely that no environment bypass applies.
|
|
/// </summary>
|
|
public static AuthenticatedDashboardRoleRequirement AnyDashboardRole { get; } =
|
|
new([DashboardRoles.Admin, DashboardRoles.Viewer]);
|
|
}
|