Add role-based access control

src/Directory.Packages.props

@@ -82,6 +82,7 @@
     <PackageVersion Include="System.Reflection.MetadataLoadContext" Version="10.0.9" />
     <PackageVersion Include="System.ServiceProcess.ServiceController" Version="10.0.9" />
     <PackageVersion Include="Validar.Fody" Version="1.9.0" />
+    <PackageVersion Include="Verify.NUnit" Version="31.20.0" />
     <PackageVersion Include="Yarp.ReverseProxy" Version="2.3.0" />
   </ItemGroup>
   <ItemGroup Label="Versions to pin transitive references">

src/Particular.LicensingComponent/Particular.LicensingComponent.csproj

@@ -13,6 +13,7 @@
   <ItemGroup>
     <ProjectReference Include="..\Particular.LicensingComponent.Persistence\Particular.LicensingComponent.Persistence.csproj" />
     <ProjectReference Include="..\ServiceControl.Api\ServiceControl.Api.csproj" />
+    <ProjectReference Include="..\ServiceControl.Infrastructure\ServiceControl.Infrastructure.csproj" />
     <ProjectReference Include="..\ServiceControl.Transports\ServiceControl.Transports.csproj" />
   </ItemGroup>
 

src/Particular.LicensingComponent/WebApi/LicensingController.cs

@@ -5,10 +5,12 @@
     using System.Text.Json;
     using System.Threading;
     using Contracts;
+    using Microsoft.AspNetCore.Authorization;
     using Microsoft.AspNetCore.Http;
     using Microsoft.AspNetCore.Mvc;
     using Microsoft.Net.Http.Headers;
     using Particular.LicensingComponent.Report;
+    using ServiceControl.Infrastructure.Auth;
 
     [ApiController]
     [Route("api/licensing")]
@@ -19,13 +21,15 @@ public LicensingController(IThroughputCollector throughputCollector)
             this.throughputCollector = throughputCollector;
         }
 
+        [Authorize(Policy = Permissions.ErrorThroughputView)]
         [Route("endpoints")]
         [HttpGet]
         public async Task<List<EndpointThroughputSummary>> GetEndpointThroughput(CancellationToken cancellationToken)
         {
             return await throughputCollector.GetThroughputSummary(cancellationToken);
         }
 
+        [Authorize(Policy = Permissions.ErrorThroughputManage)]
         [Route("endpoints/update")]
         [HttpPost]
         public async Task<IActionResult> UpdateUserSelectionOnEndpointThroughput(List<UpdateUserIndicator> updateUserIndicators, CancellationToken cancellationToken)
@@ -34,13 +38,15 @@ public async Task<IActionResult> UpdateUserSelectionOnEndpointThroughput(List<Up
             return Ok();
         }
 
+        [Authorize(Policy = Permissions.ErrorThroughputView)]
         [Route("report/available")]
         [HttpGet]
         public async Task<ReportGenerationState> CanThroughputReportBeGenerated(CancellationToken cancellationToken)
         {
             return await throughputCollector.GetReportGenerationState(cancellationToken);
         }
 
+        [Authorize(Policy = Permissions.ErrorThroughputView)]
         [Route("report/file")]
         [HttpGet]
         public async Task GetThroughputReportFile([FromQuery(Name = "spVersion")] string? spVersion, CancellationToken cancellationToken)
@@ -77,24 +83,28 @@ public async Task GetThroughputReportFile([FromQuery(Name = "spVersion")] string
             await JsonSerializer.SerializeAsync(entryStream, report, SerializationOptions.IndentedWithNoEscaping, cancellationToken);
         }
 
+        [Authorize(Policy = Permissions.ErrorThroughputView)]
         [Route("settings/info")]
         [HttpGet]
         public async Task<ThroughputConnectionSettings> GetThroughputSettingsInformation(CancellationToken cancellationToken)
         {
             return await throughputCollector.GetThroughputConnectionSettingsInformation(cancellationToken);
         }
 
+        [Authorize(Policy = Permissions.ErrorThroughputView)]
         [Route("settings/test")]
         [HttpGet]
         public async Task<ConnectionTestResults> TestThroughputConnectionSettings(CancellationToken cancellationToken) => await throughputCollector.TestConnectionSettings(cancellationToken);
 
+        [Authorize(Policy = Permissions.ErrorThroughputView)]
         [Route("settings/masks")]
         [HttpGet]
         public async Task<List<string>> GetMasks(CancellationToken cancellationToken)
         {
             return await throughputCollector.GetReportMasks(cancellationToken);
         }
 
+        [Authorize(Policy = Permissions.ErrorThroughputManage)]
         [Route("settings/masks/update")]
         [HttpPost]
         public async Task<IActionResult> UpdateMasks(List<string> updateMasks, CancellationToken cancellationToken)

src/ServiceControl.AcceptanceTesting/OpenIdConnect/MockOidcServer.cs

@@ -184,9 +184,13 @@ public string GenerateToken(
         {
             var credentials = new SigningCredentials(securityKey, SecurityAlgorithms.RsaSha256);
 
+            // sub + preferred_username are required by PermissionVerbHandler for the audit log;
+            // defaulting them here keeps callers concise. Callers that need to test the
+            // missing-claim path pass an explicit additionalClaim with an empty value to override.
             var claims = new List<Claim>
             {
                 new(JwtRegisteredClaimNames.Sub, subject),
+                new("preferred_username", subject),
                 new(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString())
             };
 

src/ServiceControl.AcceptanceTesting/OpenIdConnect/OpenIdConnectTestConfiguration.cs

@@ -34,6 +34,18 @@ public OpenIdConnectTestConfiguration WithAuthenticationDisabled()
             return this;
         }
 
+        /// <summary>
+        /// Enables role-based authorization. When on, controllers carrying
+        /// <c>[Authorize(Policy = Permissions.X)]</c> require the caller's "roles" claim to map to a
+        /// role that grants the permission via <c>RolePermissions</c>. When off, the policy provider
+        /// returns allow-all policies and any authenticated request reaches the controller.
+        /// </summary>
+        public OpenIdConnectTestConfiguration WithRoleBasedAuthorizationEnabled()
+        {
+            SetEnvironmentVariable("AUTHENTICATION_ROLEBASEDAUTHORIZATIONENABLED", "true");
+            return this;
+        }
+
         /// <summary>
         /// Disables settings validation. This allows testing with placeholder/fake OIDC settings.
         /// Should only be used in test scenarios where a real OIDC provider is not available.
@@ -164,6 +176,7 @@ public void ClearConfiguration()
             ClearEnvironmentVariable("AUTHENTICATION_SERVICEPULSE_CLIENTID");
             ClearEnvironmentVariable("AUTHENTICATION_SERVICEPULSE_APISCOPES");
             ClearEnvironmentVariable("AUTHENTICATION_SERVICEPULSE_AUTHORITY");
+            ClearEnvironmentVariable("AUTHENTICATION_ROLEBASEDAUTHORIZATIONENABLED");
             ClearEnvironmentVariable("VALIDATECONFIG");
         }
 

src/ServiceControl.AcceptanceTests.RavenDB/StartupModeTests.cs

@@ -1,10 +1,13 @@
 namespace ServiceControl.AcceptanceTests.RavenDB
 {
     using System;
+    using System.Linq;
     using System.Runtime.Loader;
     using System.Threading.Tasks;
     using Hosting.Commands;
+    using Microsoft.Extensions.DependencyInjection;
     using Microsoft.Extensions.Hosting;
+    using NServiceBus;
     using NUnit.Framework;
     using Particular.ServiceControl.Hosting;
     using Persistence;
@@ -54,5 +57,42 @@ public async Task CanRunMaintenanceMode()
         [Test]
         public async Task CanRunImportFailedMessagesMode()
             => await new ImportFailedErrorsCommand().Execute(new HostArguments([]), settings);
+
+        [Test]
+        public async Task ImportFailedErrorsHostCanActivateAllMessageHandlers()
+        {
+            // The import host consumes the instance's regular input queue, so pending recoverability
+            // commands (e.g. ArchiveMessage from a bulk archive) can arrive while it runs. Every
+            // handler of the RecoverabilityComponent the host registers must therefore be activatable.
+            var handlerTypes = typeof(ImportFailedErrorsCommand).Assembly.GetTypes()
+                .Where(type => !type.IsAbstract && type.GetInterfaces().Any(
+                    i => i.IsGenericType && i.GetGenericTypeDefinition() == typeof(IHandleMessages<>)))
+                .Where(type => type.Namespace!.StartsWith("ServiceControl.Recoverability") ||
+                               type.Namespace.StartsWith("ServiceControl.MessageFailures"))
+                .OrderBy(type => type.FullName)
+                .ToArray();
+
+            Assert.That(handlerTypes, Is.Not.Empty);
+
+            using var host = ImportFailedErrorsCommand.BuildHost(settings);
+            await host.StartAsync();
+            try
+            {
+                await using var scope = host.Services.CreateAsyncScope();
+                Assert.Multiple(() =>
+                {
+                    foreach (var handlerType in handlerTypes)
+                    {
+                        // NServiceBus activates handlers via ActivatorUtilities, resolving constructor
+                        // dependencies from the container without the handler type being registered.
+                        Assert.That(() => ActivatorUtilities.CreateInstance(scope.ServiceProvider, handlerType), Throws.Nothing, handlerType.FullName);
+                    }
+                });
+            }
+            finally
+            {
+                await host.StopAsync();
+            }
+        }
     }
 }

src/ServiceControl.AcceptanceTests/Security/OpenIdConnect/When_authentication_is_enabled.cs

@@ -1,6 +1,7 @@
 namespace ServiceControl.AcceptanceTests.Security.OpenIdConnect
 {
     using System.Net.Http;
+    using System.Security.Claims;
     using System.Threading.Tasks;
     using AcceptanceTesting;
     using AcceptanceTesting.OpenIdConnect;
@@ -35,6 +36,7 @@ public void ConfigureAuth()
             configuration = new OpenIdConnectTestConfiguration(ServiceControlInstanceType.Primary)
                 .WithConfigurationValidationDisabled()
                 .WithAuthenticationEnabled()
+                .WithRoleBasedAuthorizationEnabled()
                 .WithAuthority(mockOidcServer.Authority)
                 .WithAudience(TestAudience)
                 .WithServicePulseClientId(TestClientId)
@@ -124,7 +126,10 @@ public async Task Should_accept_requests_with_valid_bearer_token()
             _ = await Define<Context>()
                 .Done(async ctx =>
                 {
-                    var validToken = mockOidcServer.GenerateToken();
+                    // The "reader" role grants every :view permission, including error:messages:view
+                    // required by /api/errors. Without a role-bearing claim the request would be 403.
+                    var validToken = mockOidcServer.GenerateToken(
+                        additionalClaims: new[] { new Claim("roles", "reader") });
                     response = await OpenIdConnectAssertions.SendRequestWithBearerToken(
                         HttpClient,
                         HttpMethod.Get,

src/ServiceControl.AcceptanceTests/Security/OpenIdConnect/When_my_routes_are_requested.cs

@@ -0,0 +1,67 @@
+namespace ServiceControl.AcceptanceTests.Security.OpenIdConnect;
+
+using System.Collections.Generic;
+using System.Linq;
+using System.Net.Http;
+using System.Security.Claims;
+using System.Text.Json;
+using System.Threading.Tasks;
+using AcceptanceTesting;
+using AcceptanceTesting.OpenIdConnect;
+using NServiceBus.AcceptanceTesting;
+using NUnit.Framework;
+using ServiceControl.Infrastructure.Auth;
+
+/// <summary>
+/// my/routes returns the API routes the current token may call, as { method, url_template } entries.
+/// It is the per-instance authorization contract ServicePulse consumes: it gates UI on routes it
+/// already calls rather than on the server's internal permission vocabulary.
+/// </summary>
+class When_my_routes_are_requested : AcceptanceTest
+{
+    OpenIdConnectTestConfiguration configuration;
+    MockOidcServer mockOidcServer;
+
+    const string TestAudience = "api://test-audience";
+
+    [SetUp]
+    public void ConfigureAuth()
+    {
+        mockOidcServer = new MockOidcServer(audience: TestAudience);
+        mockOidcServer.Start();
+
+        configuration = new OpenIdConnectTestConfiguration(ServiceControlInstanceType.Primary)
+            .WithConfigurationValidationDisabled()
+            .WithAuthenticationEnabled()
+            .WithRoleBasedAuthorizationEnabled()
+            .WithAuthority(mockOidcServer.Authority)
+            .WithAudience(TestAudience)
+            .WithRequireHttpsMetadata(false);
+    }
+
+    [TearDown]
+    public void CleanupAuth()
+    {
+        configuration?.Dispose();
+        mockOidcServer?.Dispose();
+    }
+
+    [Test]
+    public async Task Should_reject_requests_without_bearer_token()
+    {
+        HttpResponseMessage response = null;
+
+        _ = await Define<Context>()
+            .Done(async ctx =>
+            {
+                response = await OpenIdConnectAssertions.SendRequestWithoutAuth(
+                    HttpClient, HttpMethod.Get, "/api/my/routes");
+                return response != null;
+            })
+            .Run();
+
+        OpenIdConnectAssertions.AssertUnauthorized(response);
+    }
+
+    class Context : ScenarioContext;
+}

src/ServiceControl.AcceptanceTests/TestSupport/ServiceControlComponentRunner.cs

@@ -127,6 +127,7 @@ async Task InitializeServiceControl(ScenarioContext context)
 
                 hostBuilder.Services.AddScenarioContext(context);
                 hostBuilder.AddServiceControlAuthentication(settings.OpenIdConnectSettings);
+                hostBuilder.AddServiceControlAuthorization(settings.OpenIdConnectSettings);
                 hostBuilder.AddServiceControl(settings, configuration);
                 hostBuilder.AddServiceControlHttps(settings.HttpsSettings);
                 hostBuilder.AddServiceControlApi(settings.CorsSettings);

src/ServiceControl.Api/Contracts/RootUrls.cs

@@ -20,5 +20,6 @@ public class RootUrls
         public string EventLogItems { get; set; }
         public string ArchivedGroupsUrl { get; set; }
         public string GetArchiveGroup { get; set; }
+        public string MyRoutesUrl { get; set; }
     }
 }

src/ServiceControl.Audit.AcceptanceTests/Security/OpenIdConnect/When_authentication_is_enabled.cs

@@ -1,6 +1,7 @@
 namespace ServiceControl.Audit.AcceptanceTests.Security.OpenIdConnect
 {
     using System.Net.Http;
+    using System.Security.Claims;
     using System.Threading.Tasks;
     using AcceptanceTesting;
     using AcceptanceTesting.OpenIdConnect;
@@ -32,6 +33,7 @@ public void ConfigureAuth()
             configuration = new OpenIdConnectTestConfiguration(ServiceControlInstanceType.Audit)
                 .WithConfigurationValidationDisabled()
                 .WithAuthenticationEnabled()
+                .WithRoleBasedAuthorizationEnabled()
                 .WithAuthority(mockOidcServer.Authority)
                 .WithAudience(TestAudience)
                 .WithRequireHttpsMetadata(false);
@@ -92,7 +94,10 @@ public async Task Should_accept_requests_with_valid_bearer_token()
             _ = await Define<Context>()
                 .Done(async ctx =>
                 {
-                    var validToken = mockOidcServer.GenerateToken();
+                    // The "reader" role grants every :view permission, including audit:message:view
+                    // required by /api/messages. Without a role-bearing claim the request would be 403.
+                    var validToken = mockOidcServer.GenerateToken(
+                        additionalClaims: new[] { new Claim("roles", "reader") });
                     response = await OpenIdConnectAssertions.SendRequestWithBearerToken(
                         HttpClient,
                         HttpMethod.Get,

src/ServiceControl.Audit.AcceptanceTests/TestSupport/ServiceControlComponentRunner.cs

@@ -122,6 +122,7 @@ async Task InitializeServiceControl(ScenarioContext context)
                 });
                 hostBuilder.Services.AddScenarioContext(context);
                 hostBuilder.AddServiceControlAuthentication(settings.OpenIdConnectSettings);
+                hostBuilder.AddServiceControlAuthorization(settings.OpenIdConnectSettings);
                 hostBuilder.AddServiceControlAudit((criticalErrorContext, cancellationToken) =>
                 {
                     var logitem = new ScenarioContext.LogItem