Joseph Doherty
17f16ea181
SEC-07: add QueryActiveAlarmsRequest -> events:read scope arm; fix two tests that
constructed StreamAlarmsRequest instead of QueryActiveAlarmsRequest.
SEC-05: shorten hub-token lifetime 30m -> 5m; document that the ?access_token= query
carriage must never be request-logged.
SEC-08: gateway-side CachingApiKeyVerifier (short TTL, keyed on a hash of the presented
secret) skips the per-call store read+last_used write; CoalescingMarkApiKeyStore bounds
last_used writes to <=1/key/min; identity constraints are cached. Invalidation is wired
at the gateway admin sites (revoke/rotate/delete); short TTL backstops out-of-process CLI.
SEC-11: fixed-window rate limit on POST /auth/login + a per-peer (key-id) failure limiter
checked before VerifyAsync; new MxGateway:Security options bound + validated.
Also fixes regressions from the SEC-01/04/06 commit (c185f62) that a narrow test filter
missed (all now covered by a full-suite checkpoint):
- Rooting check is cross-platform: accepts Windows C:\/UNC forms on Unix so the shipped
appsettings path validates on the macOS dev box, still rejecting bare filenames.
- AddGatewayConfiguration TryAdds a non-production IHostEnvironment fallback so the validator
resolves in minimal test/tooling containers; the real host + apikey CLI register the actual
environment first (TryAdd no-op there).
- Test assembly defaults ASPNETCORE_ENVIRONMENT=Development (ModuleInitializer) so full-host
tests exercise wiring instead of tripping the SEC-04/06 production guards.
- GatewayOptionsTests asserts the SEC-01 CommonApplicationData-derived default (platform-correct).
archreview: SEC-07/05/08/11 (P1). Verified: NonWindows build clean; full gateway suite
747 passed / 42 failed, where all 42 are the pre-existing macOS named-pipe-harness failures
(Unix-socket path limit) and 0 are validation/regression failures.
76 lines
3.4 KiB
C#
76 lines
3.4 KiB
C#
using System.Collections.Concurrent;
|
|
|
|
using LibApiKeyIdentity = ZB.MOM.WW.Auth.Abstractions.ApiKeys.ApiKeyIdentity;
|
|
|
|
namespace ZB.MOM.WW.MxGateway.Server.Security.Authentication;
|
|
|
|
/// <summary>
|
|
/// Maps the shared <see cref="ZB.MOM.WW.Auth.Abstractions.ApiKeys.ApiKeyIdentity"/> (which
|
|
/// carries the key's scopes plus the opaque constraints JSON blob) onto the gateway's
|
|
/// <see cref="ApiKeyIdentity"/> (which exposes the deserialized
|
|
/// <see cref="ApiKeyConstraints"/> the downstream authorization code enforces).
|
|
/// </summary>
|
|
/// <remarks>
|
|
/// The shared verifier does not interpret the constraints column; it returns the stored
|
|
/// JSON verbatim in <see cref="ZB.MOM.WW.Auth.Abstractions.ApiKeys.ApiKeyIdentity.Constraints"/>.
|
|
/// This mapper re-hydrates it via <see cref="ApiKeyConstraintSerializer"/> so the gateway's
|
|
/// constraint enforcement (<c>ConstraintEnforcer</c>) and request-identity accessor continue
|
|
/// to operate on the strongly-typed model unchanged.
|
|
/// </remarks>
|
|
public static class GatewayApiKeyIdentityMapper
|
|
{
|
|
// SEC-08: memoize the constraints deserialization keyed by the raw JSON blob so the per-call
|
|
// JSON parse on the auth hot path collapses to a dictionary lookup. Distinct blobs are bounded
|
|
// by the number of API keys (small); ApiKeyConstraints is an immutable record, so a parsed
|
|
// instance is safe to share across callers. The cap is a defensive backstop against a pathological
|
|
// spread of distinct blobs — past it, we simply parse without caching rather than grow unbounded.
|
|
private const int MaxCachedConstraintBlobs = 1024;
|
|
private static readonly ConcurrentDictionary<string, ApiKeyConstraints> ConstraintCache =
|
|
new(StringComparer.Ordinal);
|
|
|
|
private static ApiKeyConstraints DeserializeConstraints(string? constraintsJson)
|
|
{
|
|
if (string.IsNullOrWhiteSpace(constraintsJson))
|
|
{
|
|
return ApiKeyConstraints.Empty;
|
|
}
|
|
|
|
if (ConstraintCache.TryGetValue(constraintsJson, out ApiKeyConstraints? cached))
|
|
{
|
|
return cached;
|
|
}
|
|
|
|
ApiKeyConstraints parsed = ApiKeyConstraintSerializer.Deserialize(constraintsJson);
|
|
if (ConstraintCache.Count < MaxCachedConstraintBlobs)
|
|
{
|
|
ConstraintCache.TryAdd(constraintsJson, parsed);
|
|
}
|
|
|
|
return parsed;
|
|
}
|
|
|
|
/// <summary>
|
|
/// Converts a shared API-key identity into the gateway identity, deserializing the opaque
|
|
/// constraints JSON into <see cref="ApiKeyConstraints"/>.
|
|
/// </summary>
|
|
/// <param name="identity">The shared identity returned by the library verifier.</param>
|
|
/// <returns>The gateway identity carrying the effective constraints.</returns>
|
|
public static ApiKeyIdentity ToGatewayIdentity(LibApiKeyIdentity identity)
|
|
{
|
|
ArgumentNullException.ThrowIfNull(identity);
|
|
|
|
// The library stores the opaque constraints blob in Constraints as the ConstraintsJson
|
|
// string (or null when the key has no constraints).
|
|
string? constraintsJson = identity.Constraints as string;
|
|
|
|
return new ApiKeyIdentity(
|
|
KeyId: identity.KeyId,
|
|
// The gateway token prefix is fixed ("mxgw"); the key id is its own field. KeyPrefix
|
|
// is retained only for surface compatibility with the gateway identity record.
|
|
KeyPrefix: "mxgw",
|
|
DisplayName: identity.DisplayName,
|
|
Scopes: identity.Scopes,
|
|
Constraints: DeserializeConstraints(constraintsJson));
|
|
}
|
|
}
|