Repair router frontdoor convergence and live route contracts

2026-03-09 19:09:19 +02:00
parent 49d1c57597
commit bf937c9395
25 changed files with 740 additions and 61 deletions
--- a/src/Router/StellaOps.Gateway.WebService/Middleware/IdentityHeaderPolicyMiddleware.cs
+++ b/src/Router/StellaOps.Gateway.WebService/Middleware/IdentityHeaderPolicyMiddleware.cs
@@ -433,6 +433,14 @@ public sealed class IdentityHeaderPolicyMiddleware
            scopes.Add("scheduler.runs.preview");
            scopes.Add("scheduler.runs.manage");
        }
+
+        // Legacy operator sessions still mint orch:quota and rely on the gateway to
+        // resolve the equivalent fine-grained quota scopes before frontdoor auth.
+        if (scopes.Contains("orch:quota"))
+        {
+            scopes.Add("quota.read");
+            scopes.Add("quota.admin");
+        }
    }

    private void StoreIdentityContext(HttpContext context, IdentityContext identity)