Joseph Doherty
ca0cf19a1f
A bulk command with N denied items wrote N audit events into the bounded, drop-on-full audit channel, so a low-privilege key could evict every other pending audit record. Bulk filters now accumulate a ConstraintDenialSummary (count, constraint names, <=20 sample targets) and write one aggregated constraint-denied event per command. The per-item constraint checks are synchronous, so IConstraintEnforcer's Check* methods now return ValueTask instead of allocating a Task per item.
52 lines
1.8 KiB
C#
52 lines
1.8 KiB
C#
using ZB.MOM.WW.MxGateway.Server.Security.Authentication;
|
|
using ZB.MOM.WW.MxGateway.Server.Security.Authorization;
|
|
using ZB.MOM.WW.MxGateway.Server.Sessions;
|
|
|
|
namespace ZB.MOM.WW.MxGateway.Tests.TestSupport;
|
|
|
|
/// <summary>
|
|
/// <see cref="IConstraintEnforcer"/> that permits every operation, for tests that
|
|
/// exercise gRPC service or interceptor behaviour without constraint policy.
|
|
/// </summary>
|
|
public sealed class AllowAllConstraintEnforcer : IConstraintEnforcer
|
|
{
|
|
/// <inheritdoc />
|
|
public ValueTask<ConstraintFailure?> CheckReadTagAsync(
|
|
ApiKeyIdentity? identity,
|
|
string tagAddress,
|
|
CancellationToken cancellationToken) => ValueTask.FromResult<ConstraintFailure?>(null);
|
|
|
|
/// <inheritdoc />
|
|
public ValueTask<ConstraintFailure?> CheckReadHandleAsync(
|
|
ApiKeyIdentity? identity,
|
|
GatewaySession session,
|
|
int serverHandle,
|
|
int itemHandle,
|
|
CancellationToken cancellationToken) => ValueTask.FromResult<ConstraintFailure?>(null);
|
|
|
|
/// <inheritdoc />
|
|
public ValueTask<ConstraintFailure?> CheckWriteHandleAsync(
|
|
ApiKeyIdentity? identity,
|
|
GatewaySession session,
|
|
int serverHandle,
|
|
int itemHandle,
|
|
CancellationToken cancellationToken) => ValueTask.FromResult<ConstraintFailure?>(null);
|
|
|
|
/// <inheritdoc />
|
|
public Task RecordDenialAsync(
|
|
ApiKeyIdentity? identity,
|
|
string commandKind,
|
|
string target,
|
|
ConstraintFailure failure,
|
|
string? correlationId,
|
|
CancellationToken cancellationToken) => Task.CompletedTask;
|
|
|
|
/// <inheritdoc />
|
|
public Task RecordBulkDenialAsync(
|
|
ApiKeyIdentity? identity,
|
|
string commandKind,
|
|
ConstraintDenialSummary summary,
|
|
string? correlationId,
|
|
CancellationToken cancellationToken) => Task.CompletedTask;
|
|
}
|