mxaccessgw/src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardAuthenticationDefaults.cs

namespace ZB.MOM.WW.MxGateway.Server.Dashboard;

public static class DashboardAuthenticationDefaults
{
    /// <summary>Cookie scheme used to authenticate interactive dashboard requests.</summary>
    public const string AuthenticationScheme = "MxGateway.Dashboard";

    /// <summary>
    /// Bearer scheme used to authenticate SignalR hub connections. Hubs cannot
    /// reuse the browser's HttpOnly cookie when the client SignalR JS resolves
    /// the cookie scope to loopback, so the dashboard mints a short-lived
    /// data-protected bearer token on demand.
    /// </summary>
    public const string HubAuthenticationScheme = "MxGateway.Dashboard.HubToken";

    /// <summary>
    /// Policy guarding read-only dashboard pages. Allowed roles:
    /// <see cref="DashboardRoles.Admin"/> or <see cref="DashboardRoles.Viewer"/>.
    /// </summary>
    public const string ViewerPolicy = "MxGateway.Dashboard.Viewer";

    /// <summary>
    /// Policy guarding write-capable dashboard pages and admin endpoints
    /// (API-key CRUD, settings edits, hub publishes). Allowed role:
    /// <see cref="DashboardRoles.Admin"/>.
    /// </summary>
    public const string AdminPolicy = "MxGateway.Dashboard.Admin";

    /// <summary>
    /// Policy attached to SignalR hubs — accepts either the cookie scheme
    /// (in-page connect) or the hub-token bearer scheme (cross-origin or
    /// WebSocket connect where the cookie can't be forwarded).
    /// </summary>
    public const string HubClientsPolicy = "MxGateway.Dashboard.HubClients";

    /// <summary>
    /// Policy guarding the alarm feed — the <c>AlarmsHub</c> SignalR surface and the
    /// <c>/alarms</c> page that reads the same central monitor in process. Accepts the
    /// same two schemes as <see cref="HubClientsPolicy"/> but carries
    /// <see cref="AuthenticatedDashboardRoleRequirement"/>, a requirement type
    /// <see cref="DashboardAuthorizationHandler"/> does not handle, so the environment bypasses
    /// (<c>Authentication:Mode=Disabled</c> and anonymous localhost) cannot satisfy it. The alarm
    /// feed is galaxy-wide and session-less, so unlike a session event stream there is no tag
    /// intersection to narrow it with — requiring a real role claim is the available narrowing.
    /// </summary>
    public const string AlarmsPolicy = "MxGateway.Dashboard.Alarms";

    public const string LdapGroupClaimType = "mxgateway:ldap_group";
    public const string KeyPrefixClaimType = "mxgateway:key_prefix";

    /// <summary>
    /// Claim carrying one dashboard event-visibility tag the caller is granted. Stamped
    /// at cookie login by <see cref="DashboardAuthenticator"/> and at hub-token mint by
    /// <see cref="HubTokenService"/>, both resolving the caller's LDAP groups through
    /// <c>MxGateway:Dashboard:GroupToTag</c>. <see cref="IDashboardSessionAcl"/> reads
    /// this claim only as a FALLBACK, for a principal that carries no
    /// <see cref="LdapGroupClaimType"/> claims to re-resolve from (the hub-token principal, whose
    /// payload carries tags but not groups); a cookie principal is re-resolved against current
    /// options instead, so a stamped tag cannot outlive a config-revoked grant. A principal
    /// carrying neither kind of claim is an empty-grant Viewer, which is the fail-closed default.
    /// Visibility only — it never grants data access.
    /// </summary>
    public const string DashboardTagClaimType = "zb:dashboardtag";

    /// <summary>
    /// Dashboard auth cookie name used when the cookie is not guaranteed to be Secure
    /// (<c>RequireHttpsCookie=false</c> → <see cref="Microsoft.AspNetCore.Authentication.Cookies.CookieSecurePolicy.SameAsRequest"/>)
    /// or when an explicit <c>MxGateway:Dashboard:CookieName</c> override is absent but the
    /// secure default cannot be applied. This plain name carries no browser-enforced guarantees.
    /// </summary>
    public const string CookieName = "MxGatewayDashboard";

    /// <summary>
    /// Dashboard auth cookie name applied when the cookie is guaranteed Secure
    /// (<c>RequireHttpsCookie=true</c> → <see cref="Microsoft.AspNetCore.Authentication.Cookies.CookieSecurePolicy.Always"/>)
    /// and no explicit <c>MxGateway:Dashboard:CookieName</c> override is set. The <c>__Host-</c>
    /// prefix instructs browsers to enforce Secure, no <c>Domain</c>, and <c>Path=/</c>; those
    /// guarantees only hold for a Secure cookie, so this name must never be applied unless
    /// <see cref="Microsoft.AspNetCore.Authentication.Cookies.CookieSecurePolicy.Always"/> is in
    /// effect — a <c>__Host-</c> cookie without Secure is silently dropped by browsers.
    /// </summary>
    public const string SecureCookieName = "__Host-MxGatewayDashboard";
}