feat(secrets-ui): RCL + authz policies + metadata-only secrets list

2026-07-15 17:10:40 -04:00
parent 7f1db1b214
commit d7f8ca455b
7 changed files with 294 additions and 16 deletions
@@ -0,0 +1,84 @@
+@namespace ZB.MOM.WW.Secrets.Ui
+@implements IDisposable
+@inject ISecretStore Store
+@* Components/SecretsList.razor — metadata-only listing of secrets. Never renders a value or ciphertext. *@
+
+<TechCard Title="Secrets">
+    @if (_secrets is null)
+    {
+        <p class="mono">Loading…</p>
+    }
+    else
+    {
+        <div class="table-wrap">
+            <table class="data-table">
+                <thead>
+                    <tr>
+                        <th>Name</th>
+                        <th>Description</th>
+                        <th>Content type</th>
+                        <th>KEK</th>
+                        <th class="num">Revision</th>
+                        <th>Updated (UTC)</th>
+                        <th>Updated by</th>
+                        <th></th>
+                    </tr>
+                </thead>
+                <tbody>
+                    @if (_secrets.Count == 0)
+                    {
+                        <tr>
+                            <td class="empty-row" colspan="8">No secrets.</td>
+                        </tr>
+                    }
+                    else
+                    {
+                        @foreach (SecretMetadata secret in _secrets)
+                        {
+                            <tr>
+                                <td class="mono">@secret.Name.Value</td>
+                                <td>@secret.Description</td>
+                                <td>@secret.ContentType</td>
+                                <td class="mono">@secret.KekId</td>
+                                <td class="num">@secret.Revision</td>
+                                <td class="mono">@secret.UpdatedUtc.UtcDateTime.ToString("u")</td>
+                                <td>@secret.UpdatedBy</td>
+                                <td>
+                                    <AuthorizeView Policy="@SecretsAuthorization.RevealPolicy">
+                                        @* Placeholder — actual reveal wiring is a later task. Gated so it
+                                           renders only for principals holding the reveal policy. *@
+                                        <button type="button"
+                                                class="btn btn-outline-secondary reveal-secret"
+                                                disabled
+                                                title="Reveal (coming soon)"
+                                                data-secret-name="@secret.Name.Value">
+                                            Reveal
+                                        </button>
+                                    </AuthorizeView>
+                                </td>
+                            </tr>
+                        }
+                    }
+                </tbody>
+            </table>
+        </div>
+    }
+</TechCard>
+
+@code {
+    private readonly CancellationTokenSource _cts = new();
+    private IReadOnlyList<SecretMetadata>? _secrets;
+
+    /// <inheritdoc />
+    protected override async Task OnInitializedAsync()
+    {
+        _secrets = await Store.ListAsync(includeDeleted: false, _cts.Token);
+    }
+
+    /// <inheritdoc />
+    public void Dispose()
+    {
+        _cts.Cancel();
+        _cts.Dispose();
+    }
+}