Joseph Doherty
dc9c0c950c
Apply the ZB.MOM.WW. prefix to all gateway-side projects, folders,
.csproj/.sln contents, C# namespaces, using directives, generated proto
C# (csharp_namespace + checked-in generated files), InternalsVisibleTo
attributes, project-name string literals (LoadProject, .sln lookups,
worker exe paths, staticwebassets manifest), and the install/script/doc
references that point at any of the above. Migrate the solution from
.sln to .slnx via `dotnet sln migrate` and delete the old file.
External-runtime identifiers are intentionally NOT prefixed so external
configuration keeps working:
- GatewayMetrics.cs MeterName ("MxGateway.Server")
- DashboardAuthenticationDefaults Scheme/Policy ("MxGateway.Dashboard")
- GatewayRequestLoggingMiddleware logger category ("MxGateway.Request")
- StaRuntime thread name ("MxGateway.Worker.STA")
- appsettings.json root section "MxGateway" + env-var prefix
MxGateway__... and secret-name MxGateway:ApiKeyPepper
- C:\ProgramData\MxGateway\ data dir paths
Also fixes two tests that were not rename-related but became visible
while validating the rename:
- WorkerLiveMxAccessSmokeTests.ShutDownAsync: cancellation that the
gateway service correctly maps to RpcException(Cancelled) per gRPC
convention was being misclassified as a stream fault. Added a sibling
catch on RpcException with StatusCode.Cancelled.
- IntegrationTestEnvironment.ResolveRepositoryRoot: extracted IsRepositoryRoot
and made it accept either a .git marker OR a .sln/.slnx next to src/
so the worker-exe walker works in non-git working copies.
clients/proto/proto-inputs.json's protoRoot updated to point at
src/ZB.MOM.WW.MxGateway.Contracts/Protos.
Verified by `dotnet build` and a full `dotnet test` of the .slnx with
MXGATEWAY_RUN_LIVE_{MXACCESS,LDAP,GALAXY}_TESTS=1:
Tests: 472/472 pass
Worker.Tests: 280/280 pass (4 dev-rig [Fact(Skip=...)] skipped)
IntegrationTests: 18/18 pass
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
65 lines
2.3 KiB
C#
65 lines
2.3 KiB
C#
using System.Security.Cryptography;
|
|
|
|
namespace ZB.MOM.WW.MxGateway.Server.Security.Authentication;
|
|
|
|
public sealed class ApiKeyVerifier(
|
|
IApiKeyParser parser,
|
|
IApiKeySecretHasher hasher,
|
|
IApiKeyStore keyStore) : IApiKeyVerifier
|
|
{
|
|
/// <summary>
|
|
/// Verifies an API key from an authorization header asynchronously.
|
|
/// </summary>
|
|
/// <param name="authorizationHeader">Authorization header value.</param>
|
|
/// <param name="cancellationToken">Cancellation token.</param>
|
|
/// <returns>Verification result.</returns>
|
|
public async Task<ApiKeyVerificationResult> VerifyAsync(
|
|
string? authorizationHeader,
|
|
CancellationToken cancellationToken)
|
|
{
|
|
if (!parser.TryParseAuthorizationHeader(authorizationHeader, out ParsedApiKey? parsedKey)
|
|
|| parsedKey is null)
|
|
{
|
|
return ApiKeyVerificationResult.Fail(ApiKeyVerificationFailure.MissingOrMalformedCredentials);
|
|
}
|
|
|
|
ApiKeyRecord? storedKey = await keyStore.FindByKeyIdAsync(parsedKey.KeyId, cancellationToken)
|
|
.ConfigureAwait(false);
|
|
|
|
if (storedKey is null)
|
|
{
|
|
return ApiKeyVerificationResult.Fail(ApiKeyVerificationFailure.KeyNotFound);
|
|
}
|
|
|
|
if (storedKey.RevokedUtc is not null)
|
|
{
|
|
return ApiKeyVerificationResult.Fail(ApiKeyVerificationFailure.KeyRevoked);
|
|
}
|
|
|
|
byte[] presentedHash;
|
|
try
|
|
{
|
|
presentedHash = hasher.HashSecret(parsedKey.Secret);
|
|
}
|
|
catch (ApiKeyPepperUnavailableException)
|
|
{
|
|
return ApiKeyVerificationResult.Fail(ApiKeyVerificationFailure.PepperUnavailable);
|
|
}
|
|
|
|
if (!CryptographicOperations.FixedTimeEquals(presentedHash, storedKey.SecretHash))
|
|
{
|
|
return ApiKeyVerificationResult.Fail(ApiKeyVerificationFailure.SecretMismatch);
|
|
}
|
|
|
|
await keyStore.MarkKeyUsedAsync(storedKey.KeyId, DateTimeOffset.UtcNow, cancellationToken)
|
|
.ConfigureAwait(false);
|
|
|
|
return ApiKeyVerificationResult.Success(new ApiKeyIdentity(
|
|
KeyId: storedKey.KeyId,
|
|
KeyPrefix: storedKey.KeyPrefix,
|
|
DisplayName: storedKey.DisplayName,
|
|
Scopes: storedKey.Scopes,
|
|
Constraints: storedKey.Constraints));
|
|
}
|
|
}
|