From 76124590f018f67ce900b09cc50e291a9e31e5c4 Mon Sep 17 00:00:00 2001
From: Joseph Doherty <dohejw01@gmail.com>
Date: Thu, 16 Jul 2026 04:11:20 -0400
Subject: [PATCH] =?UTF-8?q?fix(secrets-ui):=20admin=20role=20must=20be=20c?=
 =?UTF-8?q?anonical=20'Administrator'=20(case-sensitive)=20=E2=80=94=200.1?=
 =?UTF-8?q?.1?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reference-consumer (HistorianGateway) caught that SecretsAuthorization.AdminRole was
'administrator' (lowercase) while the family canonical role is CanonicalRole.Administrator.
ASP.NET role claims compare case-sensitively (Ordinal), so a real admin got 403 on the
secrets UI. Now nameof(CanonicalRole.Administrator).
---
 ZB.MOM.WW.Secrets/Directory.Build.props                |  2 +-
 .../src/ZB.MOM.WW.Secrets.Ui/SecretsAuthorization.cs   | 10 ++++++++--
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/ZB.MOM.WW.Secrets/Directory.Build.props b/ZB.MOM.WW.Secrets/Directory.Build.props
index 3d9b855..456ba04 100644
--- a/ZB.MOM.WW.Secrets/Directory.Build.props
+++ b/ZB.MOM.WW.Secrets/Directory.Build.props
@@ -5,7 +5,7 @@
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
     <LangVersion>latest</LangVersion>
-    <Version>0.1.0</Version>
+    <Version>0.1.1</Version>
     <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
     <PackageReadmeFile>README.md</PackageReadmeFile>
   </PropertyGroup>
diff --git a/ZB.MOM.WW.Secrets/src/ZB.MOM.WW.Secrets.Ui/SecretsAuthorization.cs b/ZB.MOM.WW.Secrets/src/ZB.MOM.WW.Secrets.Ui/SecretsAuthorization.cs
index 719885e..df96355 100644
--- a/ZB.MOM.WW.Secrets/src/ZB.MOM.WW.Secrets.Ui/SecretsAuthorization.cs
+++ b/ZB.MOM.WW.Secrets/src/ZB.MOM.WW.Secrets.Ui/SecretsAuthorization.cs
@@ -1,4 +1,5 @@
 using Microsoft.AspNetCore.Authorization;
+using ZB.MOM.WW.Auth.Abstractions.Roles;
 using ZB.MOM.WW.Auth.AspNetCore;
 
 namespace ZB.MOM.WW.Secrets.Ui;
@@ -46,8 +47,13 @@ public static class SecretsAuthorization
     /// <summary>Role that grants secret value reveal (satisfies both <see cref="RevealPolicy"/> and <see cref="ManagePolicy"/>).</summary>
     public const string RevealRole = "secrets-reveal";
 
-    /// <summary>Administrator role that satisfies every secrets policy.</summary>
-    public const string AdminRole = "administrator";
+    /// <summary>
+    /// Administrator role that satisfies every secrets policy. Uses the family's canonical
+    /// <see cref="CanonicalRole.Administrator"/> role name ("Administrator") so an existing
+    /// admin principal satisfies the secrets policies without a separate mapping. Role-claim
+    /// values are compared case-sensitively, so the exact canonical spelling matters.
+    /// </summary>
+    public const string AdminRole = nameof(CanonicalRole.Administrator);
 
     /// <summary>
     /// Registers the <see cref="ManagePolicy"/> and <see cref="RevealPolicy"/> policies on the