Joseph Doherty
04bce3ff9f
Standardize the dashboard role VALUE on the canonical six: Admin→Administrator (Viewer unchanged). Pure value rename via DashboardRoles.Admin constant + appsettings GroupToRole; the GatewayOptionsValidator allowed-set/message track the constant so they now require 'Administrator' or 'Viewer'. Enforcement is unchanged — Administrator authorizes exactly what Admin did. Dashboard roles are derived at login from LDAP groups via GroupToRole and are never persisted to the SQLite auth store, so no DB migration/seed change. UNTOUCHED: the separate gRPC API-key scope GatewayScopes.Admin = "admin" (lowercase) and every "admin" scope literal — a distinct data-plane system.
21 lines
736 B
C#
21 lines
736 B
C#
namespace ZB.MOM.WW.MxGateway.Server.Dashboard;
|
|
|
|
/// <summary>
|
|
/// Role names assigned to authenticated dashboard users. The role is derived
|
|
/// from the user's LDAP groups via <c>MxGateway:Dashboard:GroupToRole</c>.
|
|
/// </summary>
|
|
public static class DashboardRoles
|
|
{
|
|
/// <summary>
|
|
/// Read-write access: API-key CRUD, settings, any state-changing UI.
|
|
/// Canonical role value (Task 1.7); formerly <c>"Admin"</c> — pure value
|
|
/// rename, the operations this role authorizes are unchanged.
|
|
/// </summary>
|
|
public const string Admin = "Administrator";
|
|
|
|
/// <summary>
|
|
/// Read-only access: all pages render but write affordances are hidden.
|
|
/// </summary>
|
|
public const string Viewer = "Viewer";
|
|
}
|