Skip to content

Commit

Permalink
chore: Consolidate all scopes to one location with xml doc. (#1864)
Browse files Browse the repository at this point in the history
Forsøker meg i første omgang på å samle alle scopene vi bruker i
dialogporten slik at det er lett å få en oversikt over dem. @knuhau og
jeg forsøkte oss også på å komme med noen summaries for hvert scope. Her
tar vi veldig gjerne imot innspill på en bedre forklarende tekst
@oskogstad @elsand 🙏


Related issue #647

---------

Co-authored-by: Ole Jørgen Skogstad <[email protected]>
  • Loading branch information
MagnusSandgren and oskogstad authored Feb 12, 2025
1 parent 70931cf commit f8cdb36
Show file tree
Hide file tree
Showing 27 changed files with 106 additions and 117 deletions.
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
using System.Collections.Immutable;
using System.Collections.ObjectModel;

namespace Digdir.Domain.Dialogporten.Application.Common.Authorization;

Expand All @@ -8,9 +9,6 @@ public static class Constants
public const string ReadAction = "read";
public const string TransmissionReadAction = "transmissionread";
public static readonly Uri UnauthorizedUri = new("urn:dialogporten:unauthorized");
public const string CorrespondenceScope = "digdir:dialogporten.correspondence";
public const string ServiceOwnerAdminScope = "digdir:dialogporten.serviceprovider.admin";
public const string LegacyHtmlScope = "digdir:dialogporten.serviceprovider.legacyhtml";

public const string DisableAltinnEventsRequiresAdminScope =
"Disabling Altinn events requires service owner admin scope.";
Expand All @@ -22,3 +20,60 @@ public static class Constants
"CorrespondenceService"
];
}

public static class AuthorizationScope
{
/// <summary>
/// Needed to be able to modify (create/update/delete) correspondence service resources. Primarily used by the correspondence service.
/// </summary>
public const string CorrespondenceScope = "digdir:dialogporten.correspondence";

/// <summary>
/// Basic service owner scope. Needed to be able to modify (create/update/delete) dialogs owned by the authenticated service owner.
/// </summary>
public const string ServiceProvider = "digdir:dialogporten.serviceprovider";

/// <summary>
/// An extension to the service owner scope allowing access to the search endpoint.
/// </summary>
public const string ServiceProviderSearch = "digdir:dialogporten.serviceprovider.search";

/// <summary>
/// Allows the modification (create/update/delete) of dialogs on behalf of all service owners regardless of the authenticated user.
/// </summary>
public const string ServiceOwnerAdminScope = "digdir:dialogporten.serviceprovider.admin";

/// <summary>
/// Allows the user to be able to provide HTML content as part of the dialog. This is used to migrate old correspondence messages to dialogs.
/// </summary>
public const string LegacyHtmlScope = "digdir:dialogporten.serviceprovider.legacyhtml";

/// <summary>
/// Basic end user scope. Needed to be able to access the end-user apis and read dialogs the end user is authorized to see.
/// </summary>
public const string EndUser = "digdir:dialogporten";

/// <summary>
/// Same as EndUser, but does not prompt the user with a consent dialog when logging in with IdPorten.
/// </summary>
public const string EndUserNoConsent = "digdir:dialogporten.noconsent";

/// <summary>
/// Gives access to the dialogs/{dialogId}/actions/should-send-notification endpoint.
/// </summary>
public const string NotificationConditionCheck = "altinn:system/notifications.condition.check";

/// <summary>
/// Gives access to hidden development endpoints. This scope is not available in production.
/// </summary>
public const string Testing = "digdir:dialogporten.developer.test";

public static readonly Lazy<IReadOnlyCollection<string>> AllScopes = new(GetAll);
private static ReadOnlyCollection<string> GetAll() =>
typeof(AuthorizationScope)
.GetFields()
.Where(x => x.IsLiteral && !x.IsInitOnly && x.FieldType == typeof(string))
.Select(x => (string)x.GetRawConstantValue()!)
.ToList()
.AsReadOnly();
}
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@
using System.Text.Json;
using System.Text.Json.Nodes;
using System.Text.Json.Serialization;
using Digdir.Domain.Dialogporten.Application.Common.Authorization;
using Digdir.Domain.Dialogporten.Domain.Parties;
using Digdir.Domain.Dialogporten.Domain.Parties.Abstractions;
using UserIdType = Digdir.Domain.Dialogporten.Domain.Dialogs.Entities.DialogUserType.Values;
Expand All @@ -28,12 +29,6 @@ public static class ClaimsPrincipalExtensions
private const char ScopeClaimSeparator = ' ';
private const string PidClaim = "pid";


// TODO: This scope is also defined in WebAPI/GQL. Can this be fetched from a common auth lib?
// https://github.com/altinn/dialogporten/issues/647
// This could be done for all claims/scopes/prefixes etc, there are duplicates
public const string ServiceProviderScope = "digdir:dialogporten.serviceprovider";

public static bool TryGetClaimValue(this ClaimsPrincipal claimsPrincipal, string claimType,
[NotNullWhen(true)] out string? value)
{
Expand Down Expand Up @@ -233,7 +228,7 @@ public static (UserIdType, string externalId) GetUserType(this ClaimsPrincipal c
{
if (claimsPrincipal.TryGetPid(out var externalId))
{
return (claimsPrincipal.HasScope(ServiceProviderScope)
return (claimsPrincipal.HasScope(AuthorizationScope.ServiceProvider)
? UserIdType.ServiceOwnerOnBehalfOfPerson
: UserIdType.Person, externalId);
}
Expand All @@ -244,7 +239,7 @@ public static (UserIdType, string externalId) GetUserType(this ClaimsPrincipal c
return (UserIdType.SystemUser, externalId);
}

if (claimsPrincipal.HasScope(ServiceProviderScope) &&
if (claimsPrincipal.HasScope(AuthorizationScope.ServiceProvider) &&
claimsPrincipal.TryGetOrganizationNumber(out externalId))
{
return (UserIdType.ServiceOwner, externalId);
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -44,12 +44,12 @@ public async Task<IReadOnlyCollection<string>> GetCurrentUserResourceIds(Cancell

public bool UserCanModifyResourceType(string serviceResourceType) => serviceResourceType switch
{
ResourceRegistry.Constants.CorrespondenceService => _user.GetPrincipal().HasScope(Constants.CorrespondenceScope),
ResourceRegistry.Constants.CorrespondenceService => _user.GetPrincipal().HasScope(AuthorizationScope.CorrespondenceScope),
null => false,
_ => true
};

public bool IsCurrentUserServiceOwnerAdmin() => _user.GetPrincipal().HasScope(Constants.ServiceOwnerAdminScope);
public bool IsCurrentUserServiceOwnerAdmin() => _user.GetPrincipal().HasScope(AuthorizationScope.ServiceOwnerAdminScope);
}

internal sealed class LocalDevelopmentUserResourceRegistryDecorator : IUserResourceRegistry
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -96,5 +96,5 @@ DialogContentType.Values.MainContentReference when UserHasLegacyHtmlScope(user)
_ => contentType.AllowedMediaTypes
};
private static bool UserHasLegacyHtmlScope(IUser? user)
=> user is not null && user.GetPrincipal().HasScope(Constants.LegacyHtmlScope);
=> user is not null && user.GetPrincipal().HasScope(AuthorizationScope.LegacyHtmlScope);
}
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
using System.Collections.ObjectModel;
using System.Security.Claims;
using Digdir.Domain.Dialogporten.Application.Common.Authorization;
using Digdir.Domain.Dialogporten.Application.Externals.Presentation;

namespace Digdir.Domain.Dialogporten.GraphQL.Common.Authentication;
Expand All @@ -23,23 +23,3 @@ internal sealed class LocalDevelopmentUser : IUser

public ClaimsPrincipal GetPrincipal() => _principal;
}


internal static class AuthorizationScope
{
public const string EndUser = "digdir:dialogporten";
public const string ServiceProvider = "digdir:dialogporten.serviceprovider";
public const string ServiceProviderSearch = "digdir:dialogporten.serviceprovider.search";
public const string Testing = "digdir:dialogporten.developer.test";
public const string Correspondence = "digdir:dialogporten.correspondence";

internal static readonly Lazy<IReadOnlyCollection<string>> AllScopes = new(GetAll);

private static ReadOnlyCollection<string> GetAll() =>
typeof(AuthorizationScope)
.GetFields()
.Where(x => x.IsLiteral && !x.IsInitOnly && x.FieldType == typeof(string))
.Select(x => (string)x.GetRawConstantValue()!)
.ToList()
.AsReadOnly();
}
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
using Digdir.Domain.Dialogporten.Application.Common;
using Digdir.Domain.Dialogporten.Application.Common.Authorization;
using Digdir.Domain.Dialogporten.Application.Common.Extensions;
using Digdir.Domain.Dialogporten.GraphQL.Common.Extensions.HotChocolate;
using Microsoft.AspNetCore.Authorization;
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,4 @@
using System.Collections.ObjectModel;

namespace Digdir.Domain.Dialogporten.GraphQL.Common.Authorization;
namespace Digdir.Domain.Dialogporten.GraphQL.Common.Authorization;

internal static class AuthorizationPolicy
{
Expand All @@ -10,22 +8,3 @@ internal static class AuthorizationPolicy
public const string ServiceProviderSearch = "serviceproviderSearch";
public const string Testing = "testing";
}

internal static class AuthorizationScope
{
public const string EndUser = "digdir:dialogporten";
public const string EndUserNoConsent = "digdir:dialogporten.noconsent";
public const string ServiceProvider = "digdir:dialogporten.serviceprovider";
public const string ServiceProviderSearch = "digdir:dialogporten.serviceprovider.search";
public const string Testing = "digdir:dialogporten.developer.test";

internal static readonly Lazy<IReadOnlyCollection<string>> AllScopes = new(GetAll);

private static ReadOnlyCollection<string> GetAll() =>
typeof(AuthorizationScope)
.GetFields()
.Where(x => x.IsLiteral && !x.IsInitOnly && x.DeclaringType == typeof(string))
.Select(x => (string)x.GetRawConstantValue()!)
.ToList()
.AsReadOnly();
}
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
using System.Security.Claims;
using Digdir.Domain.Dialogporten.Application.Common.Authorization;
using Digdir.Domain.Dialogporten.Application.Common.Extensions;
using Digdir.Domain.Dialogporten.Domain.Parties;
using Digdir.Domain.Dialogporten.WebApi.Common.Authorization;
using Digdir.Domain.Dialogporten.WebApi.Common.Extensions;

namespace Digdir.Domain.Dialogporten.WebApi.Common.Authentication;
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
using Microsoft.AspNetCore.Authorization;
using Digdir.Domain.Dialogporten.Application.Common.Authorization;
using Microsoft.AspNetCore.Authorization;
using Microsoft.Extensions.Options;

namespace Digdir.Domain.Dialogporten.WebApi.Common.Authorization;
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,4 @@
using System.Collections.ObjectModel;

namespace Digdir.Domain.Dialogporten.WebApi.Common.Authorization;
namespace Digdir.Domain.Dialogporten.WebApi.Common.Authorization;

internal static class AuthorizationPolicy
{
Expand All @@ -10,23 +8,3 @@ internal static class AuthorizationPolicy
public const string ServiceProviderSearch = "serviceproviderSearch";
public const string Testing = "testing";
}

internal static class AuthorizationScope
{
public const string EndUser = "digdir:dialogporten";
public const string EndUserNoConsent = "digdir:dialogporten.noconsent";
public const string ServiceProvider = "digdir:dialogporten.serviceprovider";
public const string ServiceProviderSearch = "digdir:dialogporten.serviceprovider.search";
public const string Testing = "digdir:dialogporten.developer.test";
public const string NotificationConditionCheck = "altinn:system/notifications.condition.check";

internal static readonly Lazy<IReadOnlyCollection<string>> AllScopes = new(GetAll);

private static ReadOnlyCollection<string> GetAll() =>
typeof(AuthorizationScope)
.GetFields()
.Where(x => x.IsLiteral && !x.IsInitOnly && x.FieldType == typeof(string))
.Select(x => (string)x.GetRawConstantValue()!)
.ToList()
.AsReadOnly();
}
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
using Digdir.Domain.Dialogporten.Application.Externals.Presentation;
using Digdir.Domain.Dialogporten.WebApi.Common.Authorization;
using System.Security.Claims;
using Digdir.Domain.Dialogporten.Application.Common.Authorization;

namespace Digdir.Domain.Dialogporten.WebApi.Common;

Expand Down
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
using Digdir.Domain.Dialogporten.WebApi.Common;
using Digdir.Domain.Dialogporten.WebApi.Common.Authorization;
using Digdir.Domain.Dialogporten.Application.Common.Authorization;
using Digdir.Domain.Dialogporten.WebApi.Common.Extensions;
using FastEndpoints;
using Constants = Digdir.Domain.Dialogporten.WebApi.Common.Constants;

namespace Digdir.Domain.Dialogporten.WebApi.Endpoints.V1.EndUser.DialogTransmissions.Get;

Expand Down
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
using Digdir.Domain.Dialogporten.Application.Common.Authorization;
using Digdir.Domain.Dialogporten.Application.Features.V1.EndUser.DialogTransmissions.Queries.Search;
using Digdir.Domain.Dialogporten.WebApi.Common;
using Digdir.Domain.Dialogporten.WebApi.Common.Authorization;
using Digdir.Domain.Dialogporten.WebApi.Common.Extensions;
using FastEndpoints;
using Constants = Digdir.Domain.Dialogporten.WebApi.Common.Constants;

namespace Digdir.Domain.Dialogporten.WebApi.Endpoints.V1.EndUser.DialogTransmissions.Search;

Expand Down
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
using Digdir.Domain.Dialogporten.WebApi.Common;
using Digdir.Domain.Dialogporten.WebApi.Common.Authorization;
using Digdir.Domain.Dialogporten.Application.Common.Authorization;
using Digdir.Domain.Dialogporten.WebApi.Common.Extensions;
using Digdir.Domain.Dialogporten.WebApi.Endpoints.V1.Common.Headers;
using FastEndpoints;
using Constants = Digdir.Domain.Dialogporten.WebApi.Common.Constants;

namespace Digdir.Domain.Dialogporten.WebApi.Endpoints.V1.ServiceOwner.DialogActivities.Create;

Expand Down
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
using Digdir.Domain.Dialogporten.WebApi.Common;
using Digdir.Domain.Dialogporten.WebApi.Common.Authorization;
using Digdir.Domain.Dialogporten.Application.Common.Authorization;
using Digdir.Domain.Dialogporten.WebApi.Common.Extensions;
using FastEndpoints;
using Constants = Digdir.Domain.Dialogporten.WebApi.Common.Constants;

namespace Digdir.Domain.Dialogporten.WebApi.Endpoints.V1.ServiceOwner.DialogActivities.Get;

Expand Down
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
using Digdir.Domain.Dialogporten.Application.Common.Authorization;
using Digdir.Domain.Dialogporten.Application.Features.V1.ServiceOwner.DialogActivities.Queries.NotificationCondition;
using Digdir.Domain.Dialogporten.WebApi.Common;
using Digdir.Domain.Dialogporten.WebApi.Common.Authorization;
using Digdir.Domain.Dialogporten.WebApi.Common.Extensions;
using FastEndpoints;
using Constants = Digdir.Domain.Dialogporten.WebApi.Common.Constants;


namespace Digdir.Domain.Dialogporten.WebApi.Endpoints.V1.ServiceOwner.DialogActivities.NotificationCondition;
Expand Down
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
using Digdir.Domain.Dialogporten.Application.Common.Authorization;
using Digdir.Domain.Dialogporten.Application.Features.V1.ServiceOwner.DialogActivities.Queries.Search;
using Digdir.Domain.Dialogporten.WebApi.Common;
using Digdir.Domain.Dialogporten.WebApi.Common.Authorization;
using Digdir.Domain.Dialogporten.WebApi.Common.Extensions;
using FastEndpoints;
using Constants = Digdir.Domain.Dialogporten.WebApi.Common.Constants;

namespace Digdir.Domain.Dialogporten.WebApi.Endpoints.V1.ServiceOwner.DialogActivities.Search;

Expand Down
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
using Digdir.Domain.Dialogporten.WebApi.Common;
using Digdir.Domain.Dialogporten.WebApi.Common.Authorization;
using Digdir.Domain.Dialogporten.Application.Common.Authorization;
using Digdir.Domain.Dialogporten.WebApi.Common.Extensions;
using Digdir.Domain.Dialogporten.WebApi.Endpoints.V1.Common.Headers;
using FastEndpoints;
using Constants = Digdir.Domain.Dialogporten.WebApi.Common.Constants;

namespace Digdir.Domain.Dialogporten.WebApi.Endpoints.V1.ServiceOwner.DialogTransmissions.Create;

Expand Down
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
using Digdir.Domain.Dialogporten.WebApi.Common;
using Digdir.Domain.Dialogporten.WebApi.Common.Authorization;
using Digdir.Domain.Dialogporten.Application.Common.Authorization;
using Digdir.Domain.Dialogporten.WebApi.Common.Extensions;
using FastEndpoints;
using Constants = Digdir.Domain.Dialogporten.WebApi.Common.Constants;

namespace Digdir.Domain.Dialogporten.WebApi.Endpoints.V1.ServiceOwner.DialogTransmissions.Get;

Expand Down
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
using Digdir.Domain.Dialogporten.Application.Common.Authorization;
using Digdir.Domain.Dialogporten.Application.Features.V1.ServiceOwner.DialogTransmissions.Queries.Search;
using Digdir.Domain.Dialogporten.WebApi.Common;
using Digdir.Domain.Dialogporten.WebApi.Common.Authorization;
using Digdir.Domain.Dialogporten.WebApi.Common.Extensions;
using FastEndpoints;
using Constants = Digdir.Domain.Dialogporten.WebApi.Common.Constants;

namespace Digdir.Domain.Dialogporten.WebApi.Endpoints.V1.ServiceOwner.DialogTransmissions.Search;

Expand Down
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
using Digdir.Domain.Dialogporten.WebApi.Common;
using Digdir.Domain.Dialogporten.WebApi.Common.Authorization;
using Digdir.Domain.Dialogporten.Application.Common.Authorization;
using Digdir.Domain.Dialogporten.WebApi.Common.Extensions;
using Digdir.Domain.Dialogporten.WebApi.Endpoints.V1.Common.Headers;
using FastEndpoints;
using Constants = Digdir.Domain.Dialogporten.WebApi.Common.Constants;

namespace Digdir.Domain.Dialogporten.WebApi.Endpoints.V1.ServiceOwner.Dialogs.Create;

Expand Down
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
using Digdir.Domain.Dialogporten.WebApi.Common;
using Digdir.Domain.Dialogporten.WebApi.Common.Authorization;
using Digdir.Domain.Dialogporten.Application.Common.Authorization;
using Digdir.Domain.Dialogporten.WebApi.Common.Extensions;
using Digdir.Domain.Dialogporten.WebApi.Endpoints.V1.Common.Headers;
using FastEndpoints;
using Constants = Digdir.Domain.Dialogporten.WebApi.Common.Constants;

namespace Digdir.Domain.Dialogporten.WebApi.Endpoints.V1.ServiceOwner.Dialogs.Delete;

Expand Down
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
using Digdir.Domain.Dialogporten.WebApi.Common;
using Digdir.Domain.Dialogporten.WebApi.Common.Authorization;
using Digdir.Domain.Dialogporten.Application.Common.Authorization;
using Digdir.Domain.Dialogporten.WebApi.Common.Extensions;
using FastEndpoints;
using Constants = Digdir.Domain.Dialogporten.WebApi.Common.Constants;

namespace Digdir.Domain.Dialogporten.WebApi.Endpoints.V1.ServiceOwner.Dialogs.Get;

Expand Down
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
using Digdir.Domain.Dialogporten.WebApi.Common;
using Digdir.Domain.Dialogporten.WebApi.Common.Authorization;
using Digdir.Domain.Dialogporten.Application.Common.Authorization;
using Digdir.Domain.Dialogporten.WebApi.Common.Extensions;
using FastEndpoints;
using Constants = Digdir.Domain.Dialogporten.WebApi.Common.Constants;

namespace Digdir.Domain.Dialogporten.WebApi.Endpoints.V1.ServiceOwner.Dialogs.Purge;

Expand Down
Loading

0 comments on commit f8cdb36

Please sign in to comment.