Fix IsAccessListModeApplicable Check (#173)

* Fix IsAccessListModeApplicable Check #172 Fixed so IsAccessListModeApplicable use the users delegable right model and not the input model for the check Related Work Items: #17 * Added automated Bruno tests for AccessList: DelegationCheck and Delegation * Added test data for TT02 * Deleted duplicate test --------- Co-authored-by: Jon Kjetil Øye <[email protected]> Co-authored-by: howieandersen <[email protected]>
Altinn · Dec 17, 2024 · edc27ea · edc27ea
1 parent d808199
commit edc27ea
Show file tree

Hide file tree

Showing 44 changed files with 246 additions and 41 deletions.
diff --git a/.../Altinn.AccessManagement/src/Altinn.AccessManagement.Core/Services/SingleRightsService.cs b/.../Altinn.AccessManagement/src/Altinn.AccessManagement.Core/Services/SingleRightsService.cs
@@ -160,11 +160,12 @@ public async Task<DelegationActionResult> DelegateRights(int authenticatedUserId
             List<Right> rightsUserCantDelegate = new List<Right>();
             foreach (Right rightToDelegate in delegation.Rights)
             {
-                if (usersDelegableRights.Contains(rightToDelegate))
+                Right delegableRight = usersDelegableRights.Find(r => r.RightKey == rightToDelegate.RightKey);
+                if (delegableRight != null)
                 {
                     // If delegable and serviceResource.AccessListMode is enabled, call accessListAuthorizationClient
                     AccessListAuthorizationResult accessListAuthorizationResult = AccessListAuthorizationResult.NotApplicable;
-                    if (DelegationHelper.IsAccessListModeEnabledAndApplicable(rightToDelegate, resource, fromParty))
+                    if (DelegationHelper.IsAccessListModeEnabledAndApplicable(delegableRight, resource, fromParty))
                     {
                         AccessListAuthorizationRequest accessListAuthorizationRequest = new AccessListAuthorizationRequest
                         {

diff --git a/...on/RightsInternal/accesslist-resource/AccessListDelegationCheck_Dagl_OrgPartialAccess.bru b/...on/RightsInternal/accesslist-resource/AccessListDelegationCheck_Dagl_OrgPartialAccess.bru
@@ -0,0 +1,59 @@
+meta {
+  name: AccessListDelegationCheck_Dagl_OrgPartialAccess
+  type: http
+  seq: 1
+}
+
+post {
+  url: {{baseUrl}}/accessmanagement/api/v1/internal/{{party}}/rights/delegation/delegationcheck
+  body: json
+  auth: inherit
+}
+
+body:json {
+  {
+    "resource": [
+      {
+        "id": "urn:altinn:resource",
+        "value": "{{resource}}"
+      }
+    ]
+  }
+}
+
+script:pre-request {
+  const testdata = require(`./Testdata/accesslist-delegation/${bru.getEnvVar("tokenEnv")}.json`);
+  const sharedtestdata = require(`./Testdata/sharedtestdata.json`);
+  bru.setVar("party", testdata.OrdentligUlasteligStruts.partyid);
+  bru.setVar("resource", testdata.resource);
+
+  var getTokenParameters = {
+    auth_tokenType: sharedtestdata.authTokenType.personal,
+    auth_userId: testdata.OrdentligUlasteligStruts.dagl.userid,
+    auth_partyId: testdata.OrdentligUlasteligStruts.dagl.partyid,
+    auth_ssn: testdata.OrdentligUlasteligStruts.dagl.pid
+  }
+
+  const token = await testTokenGenerator.getToken(getTokenParameters);
+  bru.setVar("bearerToken",  token);
+}
+
+tests {
+  // Should be the same as the .bru request file. Used as prefix in test name which also shows in test result in pipeline.
+  const requestName = "AccessListDelegationCheck_Dagl_OrgPartialAccess";
+  const body = res.getBody();
+
+  test(requestName + "|HttpStatus.OK", function() {
+    expect(res.status).to.equal(200);
+  });
+
+  test(requestName + "|Read_IsDelegable", function() {
+    const right = body.find(right => right.rightKey === "devtest_gar_bruno_accesslist_actionfilter:read");
+    assert.equal(right.status, "Delegable", `Expected read to be: Delegable`);
+  });
+
+  test(requestName + "|Write_IsNotDelegable", function() {
+    const right = body.find(right => right.rightKey === "devtest_gar_bruno_accesslist_actionfilter:write");
+    assert.equal(right.status, "NotDelegable", `Expected write to be; NotDelegable`);
+  });
+}
diff --git a/...ion/RightsInternal/accesslist-resource/AccessListDelegation_Dagl_OrgPartialAccessRead.bru b/...ion/RightsInternal/accesslist-resource/AccessListDelegation_Dagl_OrgPartialAccessRead.bru
@@ -0,0 +1,85 @@
+meta {
+  name: AccessListDelegation_Dagl_OrgPartialAccessRead
+  type: http
+  seq: 2
+}
+
+post {
+  url: {{baseUrl}}/accessmanagement/api/v1/internal/{{party}}/rights/delegation/offered
+  body: json
+  auth: inherit
+}
+
+body:json {
+  {
+      "to": [
+          {
+              "id": "urn:altinn:person:identifier-no",
+              "value": "{{toSsn}}"
+          },
+          {
+              "id": "urn:altinn:person:lastname",
+              "value": "{{toLastName}}"
+          }
+      ],
+      "rights": [
+          {
+              "resource": [
+                  {
+                      "id": "urn:altinn:resource",
+                      "value": "{{resource}}"
+                  }
+              ],
+              "action": "read"
+          },
+          {
+              "resource": [
+                  {
+                      "id": "urn:altinn:resource",
+                      "value": "{{resource}}"
+                  }
+              ],
+              "action": "write"
+          }
+      ]
+  }
+}
+
+script:pre-request {
+  const testdata = require(`./Testdata/accesslist-delegation/${bru.getEnvVar("tokenEnv")}.json`);
+  const sharedtestdata = require(`./Testdata/sharedtestdata.json`);
+  bru.setVar("party", testdata.SvenskGeniærklertTiger.partyid);
+  bru.setVar("resource", testdata.resource);
+  bru.setVar("toSsn", testdata.SvenskGeniærklertTiger.dagl.pid);
+  bru.setVar("toLastName", "KRYDDERMÅL");
+
+  var getTokenParameters = {
+    auth_tokenType: sharedtestdata.authTokenType.personal,
+    auth_userId: testdata.SvenskGeniærklertTiger.dagl.userid,
+    auth_partyId: testdata.SvenskGeniærklertTiger.dagl.partyid,
+    auth_ssn: testdata.SvenskGeniærklertTiger.dagl.pid
+  }
+
+  const token = await testTokenGenerator.getToken(getTokenParameters);
+  bru.setVar("bearerToken",  token);
+}
+
+tests {
+  // Should be the same as the .bru request file. Used as prefix in test name which also shows in test result in pipeline.
+  const requestName = "AccessListDelegation_Dagl_OrgPartialAccess";
+  const body = res.getBody();
+
+  test(requestName + "|HttpStatus.OK", function() {
+    expect(res.status).to.equal(200);
+  });
+
+  test(requestName + "|Read_IsDelegable", function() {
+    const right = body.rightDelegationResults.find(right => right.rightKey === "devtest_gar_bruno_accesslist_actionfilter:read");
+    assert.equal(right.status, "Delegated", `Expected read to be: Delegated`);
+  });
+
+  test(requestName + "|Write_IsNotDelegable", function() {
+    const right = body.rightDelegationResults.find(right => right.rightKey === "devtest_gar_bruno_accesslist_actionfilter:write");
+    assert.equal(right.status, "NotDelegated", `Expected read to be: NotDelegated`);
+  });
+}
diff --git a/...atic Test Collection/RightsInternal/non-tilgangsstyrer cannot see offered delegations.bru b/...atic Test Collection/RightsInternal/non-tilgangsstyrer cannot see offered delegations.bru
@@ -1,7 +1,7 @@
 meta {
   name: non-tilgangsstyrer cannot see offered delegations
   type: http
-  seq: 41
+  seq: 42
 }
 
 get {

diff --git a/...tic Test Collection/RightsInternal/non-tilgangsstyrer cannot see received delegations.bru b/...tic Test Collection/RightsInternal/non-tilgangsstyrer cannot see received delegations.bru
@@ -1,7 +1,7 @@
 meta {
   name: non-tilgangsstyrer cannot see received delegations
   type: http
-  seq: 42
+  seq: 43
 }
 
 get {

diff --git a/...cessManagement/Automatic Test Collection/RightsInternal/o2o cannot delegate to itself.bru b/...cessManagement/Automatic Test Collection/RightsInternal/o2o cannot delegate to itself.bru
@@ -1,7 +1,7 @@
 meta {
   name: o2o cannot delegate to itself
   type: http
-  seq: 36
+  seq: 37
 }
 
 get {

diff --git a/...ccessManagement/Automatic Test Collection/RightsInternal/o2o delegate org2org (again).bru b/...ccessManagement/Automatic Test Collection/RightsInternal/o2o delegate org2org (again).bru
@@ -1,7 +1,7 @@
 meta {
   name: o2o delegate org2org (again)
   type: http
-  seq: 25
+  seq: 26
 }
 
 post {

diff --git a/...Altinn.AccessManagement/Automatic Test Collection/RightsInternal/o2o delegate org2org.bru b/...Altinn.AccessManagement/Automatic Test Collection/RightsInternal/o2o delegate org2org.bru
@@ -1,7 +1,7 @@
 meta {
   name: o2o delegate org2org
   type: http
-  seq: 21
+  seq: 22
 }
 
 post {

diff --git a/...ement/Automatic Test Collection/RightsInternal/o2o org attempts to delegate to itself.bru b/...ement/Automatic Test Collection/RightsInternal/o2o org attempts to delegate to itself.bru
@@ -1,7 +1,7 @@
 meta {
   name: o2o org attempts to delegate to itself
   type: http
-  seq: 35
+  seq: 36
 }
 
 post {

diff --git a/...Management/Automatic Test Collection/RightsInternal/o2o org2org delegation successful.bru b/...Management/Automatic Test Collection/RightsInternal/o2o org2org delegation successful.bru
@@ -1,7 +1,7 @@
 meta {
   name: o2o org2org delegation successful
   type: http
-  seq: 22
+  seq: 23
 }
 
 get {

diff --git a/...tic Test Collection/RightsInternal/o2o receiving org no longer has delegation (again).bru b/...tic Test Collection/RightsInternal/o2o receiving org no longer has delegation (again).bru
@@ -1,7 +1,7 @@
 meta {
   name: o2o receiving org no longer has delegation (again)
   type: http
-  seq: 27
+  seq: 28
 }
 
 get {

diff --git a/...t/Automatic Test Collection/RightsInternal/o2o receiving org no longer has delegation.bru b/...t/Automatic Test Collection/RightsInternal/o2o receiving org no longer has delegation.bru
@@ -1,7 +1,7 @@
 meta {
   name: o2o receiving org no longer has delegation
   type: http
-  seq: 24
+  seq: 25
 }
 
 get {

diff --git a/...utomatic Test Collection/RightsInternal/o2o receiving org revokes delegation from org.bru b/...utomatic Test Collection/RightsInternal/o2o receiving org revokes delegation from org.bru
@@ -1,7 +1,7 @@
 meta {
   name: o2o receiving org revokes delegation from org
   type: http
-  seq: 23
+  seq: 24
 }
 
 post {

diff --git a/...nt/Automatic Test Collection/RightsInternal/o2o sending org revokes delegation to org.bru b/...nt/Automatic Test Collection/RightsInternal/o2o sending org revokes delegation to org.bru
@@ -1,7 +1,7 @@
 meta {
   name: o2o sending org revokes delegation to org
   type: http
-  seq: 26
+  seq: 27
 }
 
 post {

diff --git a/...ssManagement/Automatic Test Collection/RightsInternal/o2p delegate org2person (again).bru b/...ssManagement/Automatic Test Collection/RightsInternal/o2p delegate org2person (again).bru
@@ -1,7 +1,7 @@
 meta {
   name: o2p delegate org2person (again)
   type: http
-  seq: 18
+  seq: 19
 }
 
 post {

diff --git a/...inn.AccessManagement/Automatic Test Collection/RightsInternal/o2p delegate org2person.bru b/...inn.AccessManagement/Automatic Test Collection/RightsInternal/o2p delegate org2person.bru
@@ -1,7 +1,7 @@
 meta {
   name: o2p delegate org2person
   type: http
-  seq: 14
+  seq: 15
 }
 
 post {

diff --git a/...agement/Automatic Test Collection/RightsInternal/o2p org2person delegation successful.bru b/...agement/Automatic Test Collection/RightsInternal/o2p org2person delegation successful.bru
@@ -1,7 +1,7 @@
 meta {
   name: o2p org2person delegation successful
   type: http
-  seq: 15
+  seq: 16
 }
 
 get {

diff --git a/...tomatic Test Collection/RightsInternal/o2p receiving person has no delegation (again).bru b/...tomatic Test Collection/RightsInternal/o2p receiving person has no delegation (again).bru
@@ -1,7 +1,7 @@
 meta {
   name: o2p receiving person has no delegation (again)
   type: http
-  seq: 20
+  seq: 21
 }
 
 get {

diff --git a/...utomatic Test Collection/RightsInternal/o2p receiving person no longer has delegation.bru b/...utomatic Test Collection/RightsInternal/o2p receiving person no longer has delegation.bru
@@ -1,7 +1,7 @@
 meta {
   name: o2p receiving person no longer has delegation
   type: http
-  seq: 17
+  seq: 18
 }
 
 get {

diff --git a/...matic Test Collection/RightsInternal/o2p receiving person revokes delegation from org.bru b/...matic Test Collection/RightsInternal/o2p receiving person revokes delegation from org.bru
@@ -1,7 +1,7 @@
 meta {
   name: o2p receiving person revokes delegation from org
   type: http
-  seq: 16
+  seq: 17
 }
 
 post {

diff --git a/...Automatic Test Collection/RightsInternal/o2p sending org revokes delegation to person.bru b/...Automatic Test Collection/RightsInternal/o2p sending org revokes delegation to person.bru
@@ -1,7 +1,7 @@
 meta {
   name: o2p sending org revokes delegation to person
   type: http
-  seq: 19
+  seq: 20
 }
 
 post {

diff --git a/...ssManagement/Automatic Test Collection/RightsInternal/p2o delegate person2org (again).bru b/...ssManagement/Automatic Test Collection/RightsInternal/p2o delegate person2org (again).bru
@@ -1,7 +1,7 @@
 meta {
   name: p2o delegate person2org (again)
   type: http
-  seq: 32
+  seq: 33
 }
 
 post {

diff --git a/...inn.AccessManagement/Automatic Test Collection/RightsInternal/p2o delegate person2org.bru b/...inn.AccessManagement/Automatic Test Collection/RightsInternal/p2o delegate person2org.bru
@@ -1,7 +1,7 @@
 meta {
   name: p2o delegate person2org
   type: http
-  seq: 28
+  seq: 29
 }
 
 post {

diff --git a/...agement/Automatic Test Collection/RightsInternal/p2o person2org delegation successful.bru b/...agement/Automatic Test Collection/RightsInternal/p2o person2org delegation successful.bru
@@ -1,7 +1,7 @@
 meta {
   name: p2o person2org delegation successful
   type: http
-  seq: 29
+  seq: 30
 }
 
 get {

diff --git a/...tic Test Collection/RightsInternal/p2o receiving org no longer has delegation (again).bru b/...tic Test Collection/RightsInternal/p2o receiving org no longer has delegation (again).bru
@@ -1,7 +1,7 @@
 meta {
   name: p2o receiving org no longer has delegation (again)
   type: http
-  seq: 34
+  seq: 35
 }
 
 get {

diff --git a/...t/Automatic Test Collection/RightsInternal/p2o receiving org no longer has delegation.bru b/...t/Automatic Test Collection/RightsInternal/p2o receiving org no longer has delegation.bru
@@ -1,7 +1,7 @@
 meta {
   name: p2o receiving org no longer has delegation
   type: http
-  seq: 31
+  seq: 32
 }
 
 get {

diff --git a/...matic Test Collection/RightsInternal/p2o receiving org revokes delegation from person.bru b/...matic Test Collection/RightsInternal/p2o receiving org revokes delegation from person.bru
@@ -1,7 +1,7 @@
 meta {
   name: p2o receiving org revokes delegation from person
   type: http
-  seq: 30
+  seq: 31
 }
 
 post {

diff --git a/...Automatic Test Collection/RightsInternal/p2o sending person revokes delegation to org.bru b/...Automatic Test Collection/RightsInternal/p2o sending person revokes delegation to org.bru
@@ -1,7 +1,7 @@
 meta {
   name: p2o sending person revokes delegation to org
   type: http
-  seq: 33
+  seq: 34
 }
 
 post {

diff --git a/...ent/Automatic Test Collection/RightsInternal/p2o testdata cleanup (revoke delegation).bru b/...ent/Automatic Test Collection/RightsInternal/p2o testdata cleanup (revoke delegation).bru
@@ -1,7 +1,7 @@
 meta {
   name: p2o testdata cleanup (revoke delegation)
   type: http
-  seq: 4
+  seq: 5
 }
 
 post {