Joseph Doherty
e15c3cb052
SEC-25 (near-term hardening; full per-session EventsHub ACL stays deferred to roadmap item 12): DashboardEventBroadcaster now redacts tag values from a deep CLONE of the event before mirroring to SignalR when Dashboard:ShowTagValues is false (the default). Clears MxEvent.value (covers OnDataChange/OnWriteComplete/ OperationComplete/OnBufferedDataChange — their bodies are empty discriminators, values ride in the top-level field incl. buffered arrays) and the alarm body's current_value/limit_value. Source event never mutated (shared with the gRPC path + replay ring) - verified by a source-not-mutated test. Makes the formerly dead ShowTagValues flag live for the mirror. EventsHub TODO(per-session-acl) kept and tied to roadmap item 12. Tests: DashboardEventBroadcasterTests (3). SEC-30: trim docs/Diagnostics.md to mark opt-in command-value logging as NOT YET IMPLEMENTED (no LogCommandValues knob, RedactCommandValue has no call sites, no values logged); wiring deferred pending secured-bulk redaction coverage (SEC-13). No option/call sites added. Server build clean (0 warnings); Dashboard tests 152/152. Claude-Session: https://claude.ai/code/session_01DMXXvNuPekkkrTEyPNxEkW
74 lines
3.4 KiB
C#
74 lines
3.4 KiB
C#
using Microsoft.AspNetCore.Authorization;
|
|
using Microsoft.AspNetCore.SignalR;
|
|
|
|
namespace ZB.MOM.WW.MxGateway.Server.Dashboard.Hubs;
|
|
|
|
/// <summary>
|
|
/// SignalR hub for per-session MxEvent push. Clients call
|
|
/// <see cref="SubscribeSession"/> to join the group for a specific
|
|
/// session; <see cref="DashboardEventBroadcaster"/> sends messages to
|
|
/// <c>session:{id}</c> as events arrive from the live gRPC stream.
|
|
/// </summary>
|
|
[Authorize(Policy = DashboardAuthenticationDefaults.HubClientsPolicy)]
|
|
public sealed class EventsHub : Hub
|
|
{
|
|
/// <summary>Method name used to push individual <c>MxEvent</c> values to clients.</summary>
|
|
public const string EventMessage = "MxEvent";
|
|
|
|
/// <summary>Computes the SignalR group name for a given session id.</summary>
|
|
/// <param name="sessionId">The session id.</param>
|
|
/// <returns>The group name for the session.</returns>
|
|
public static string GroupName(string sessionId) => $"session:{sessionId}";
|
|
|
|
/// <summary>
|
|
/// Subscribes the calling SignalR connection to the per-session events
|
|
/// group, so that events broadcast by
|
|
/// <see cref="DashboardEventBroadcaster"/> for that session reach this
|
|
/// client.
|
|
/// </summary>
|
|
/// <remarks>
|
|
/// In v1 the hub-level <see cref="AuthorizeAttribute"/>
|
|
/// (<c>HubClientsPolicy</c>) only checks that the caller carries one of
|
|
/// the dashboard roles (Admin or Viewer); both roles may subscribe to
|
|
/// any session id they choose. This is acceptable today because (a) the
|
|
/// dashboard's per-session views show non-secret session metadata that
|
|
/// any authenticated dashboard user can already see, and (b) tag values
|
|
/// are stripped from the mirrored events by
|
|
/// <see cref="DashboardEventBroadcaster"/> when
|
|
/// <c>MxGateway:Dashboard:ShowTagValues</c> is false (the default), so the
|
|
/// most sensitive payload cannot leak through this seam regardless of the
|
|
/// still-missing ACL. The per-session ACL that gates the gRPC
|
|
/// <c>StreamEvents</c> RPC is intentionally not yet mirrored here.
|
|
/// TODO(per-session-acl): tracked as remediation roadmap item 12
|
|
/// (SEC-25). Once a role/scope is introduced that scopes a Viewer to a
|
|
/// specific session or tenant, add a session-access check at this seam —
|
|
/// either inline (consult the per-user allowed-session set on
|
|
/// <c>Context.User</c> claims / <c>Context.Items</c>) or via a dedicated
|
|
/// authorization policy applied to the hub method itself.
|
|
/// </remarks>
|
|
/// <param name="sessionId">Session id to subscribe the caller to.</param>
|
|
/// <returns>A task representing the subscription operation.</returns>
|
|
public Task SubscribeSession(string sessionId)
|
|
{
|
|
if (string.IsNullOrWhiteSpace(sessionId))
|
|
{
|
|
return Task.CompletedTask;
|
|
}
|
|
|
|
return Groups.AddToGroupAsync(Context.ConnectionId, GroupName(sessionId));
|
|
}
|
|
|
|
/// <summary>Unsubscribes the calling SignalR connection from the per-session events group.</summary>
|
|
/// <param name="sessionId">Session id to unsubscribe the caller from.</param>
|
|
/// <returns>A task representing the unsubscription operation.</returns>
|
|
public Task UnsubscribeSession(string sessionId)
|
|
{
|
|
if (string.IsNullOrWhiteSpace(sessionId))
|
|
{
|
|
return Task.CompletedTask;
|
|
}
|
|
|
|
return Groups.RemoveFromGroupAsync(Context.ConnectionId, GroupName(sessionId));
|
|
}
|
|
}
|