dohertj2/scadaproj
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(secrets-ui): admin role must be canonical 'Administrator' (case-sensitive) — 0.1.1

Browse Source 
Reference-consumer (HistorianGateway) caught that SecretsAuthorization.AdminRole was
'administrator' (lowercase) while the family canonical role is CanonicalRole.Administrator.
ASP.NET role claims compare case-sensitively (Ordinal), so a real admin got 403 on the
secrets UI. Now nameof(CanonicalRole.Administrator).
This commit is contained in:
Joseph Doherty
2026-07-16 04:11:20 -04:00
parent 2c64683303
commit 76124590f0
2 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ZB.MOM.WW.Secrets/src/ZB.MOM.WW.Secrets.Ui/SecretsAuthorization.cs
+8 -2
View File
@@ -1,4 +1,5 @@
using Microsoft.AspNetCore.Authorization;
using ZB.MOM.WW.Auth.Abstractions.Roles;
using ZB.MOM.WW.Auth.AspNetCore;
namespace ZB.MOM.WW.Secrets.Ui;
@@ -46,8 +47,13 @@ public static class SecretsAuthorization
/// <summary>Role that grants secret value reveal (satisfies both <see cref="RevealPolicy"/> and <see cref="ManagePolicy"/>).</summary>
public const string RevealRole = "secrets-reveal";
/// <summary>Administrator role that satisfies every secrets policy.</summary>
public const string AdminRole = "administrator";
/// <summary>
/// Administrator role that satisfies every secrets policy. Uses the family's canonical
/// <see cref="CanonicalRole.Administrator"/> role name ("Administrator") so an existing
/// admin principal satisfies the secrets policies without a separate mapping. Role-claim
/// values are compared case-sensitively, so the exact canonical spelling matters.
/// </summary>
public const string AdminRole = nameof(CanonicalRole.Administrator);
/// <summary>
/// Registers the <see cref="ManagePolicy"/> and <see cref="RevealPolicy"/> policies on the