Enforces dedicated visualiser scopes.

Updates the API to use dedicated scopes for the visualiser application.

This change improves security by isolating the permissions required for visualiser functionality from the core data management system (DMS).

Author: samgibsonmoj

src/API/Endpoints/VisualisationEndpoints.cs

@@ -22,9 +22,9 @@ public static IEndpointRouteBuilder RegisterVisualisationEndpoints(this IEndpoin
 
         group.MapPost("/Save", SaveNetworkAsync)
             .ProducesProblem(StatusCodes.Status500InternalServerError)
-            .RequireAuthorization("write");
+            .RequireAuthorization("visualisation-write");
 
-        group.RequireAuthorization("read");
+        group.RequireAuthorization("visualisation-read");
 
         return routes;
     }

src/API/Program.cs

@@ -73,6 +73,17 @@
 {
     options.AddPolicy("read", policy => policy.RequireScope("dms.read"));
     options.AddPolicy("write", policy => policy.RequireScope("dms.write"));
+
+    options.AddPolicy("visualisation-read", policy => 
+        policy.RequireAuthenticatedUser()
+              .RequireScope("visualiser.read")
+              .AddAuthenticationSchemes(JwtBearerDefaults.AuthenticationScheme));
+
+    options.AddPolicy("visualisation-write", policy => 
+        policy.RequireAuthenticatedUser()
+              .RequireScope("visualiser.write")
+              .AddAuthenticationSchemes(JwtBearerDefaults.AuthenticationScheme));
+
     options.FallbackPolicy = options.DefaultPolicy;
 });
 

src/Visualiser/appsettings.Development.json

@@ -11,8 +11,8 @@
   },
   "API": {
     "Scopes": [
-      "api://916ace49-a3db-4b11-84c5-6c4bd20260ef/dms.read",
-      "api://916ace49-a3db-4b11-84c5-6c4bd20260ef/dms.write"
+      "api://916ace49-a3db-4b11-84c5-6c4bd20260ef/visualiser.read",
+      "api://916ace49-a3db-4b11-84c5-6c4bd20260ef/visualiser.write"
     ]
   }
 }

src/Visualiser/appsettings.json

@@ -17,7 +17,7 @@ For more info see https://aka.ms/dotnet-template-ms-identity-platform
   "API": {
     "BaseUrl": "https://localhost:7013",
     "Scopes": [
-      // E.g. "api://{api_client_id}/dms.read" and "api://{api_client_id}/dms.write"
+      // E.g. "api://{api_client_id}/visualiser.read" and "api://{api_client_id}/visualiser.write"
     ]
   },
   "Serilog": {