Feature/instansdelegering api put and delete#2522
Open
howieandersen wants to merge 11 commits intomainfrom
Open
Feature/instansdelegering api put and delete#2522howieandersen wants to merge 11 commits intomainfrom
howieandersen wants to merge 11 commits intomainfrom
Conversation
instance-level delegations with filtering by party, resource, and instance. Key changes: - Add InstanceIds and IncludeInstances properties to ConnectionQueryFilter - Create ConnectionQueryInstance model for instance query results - Add Instances collection to ConnectionQueryExtendedRecord - Implement LoadInstancesByKeyAsync joining with AssignmentInstance table - Add ResourceId filtering to scope instances to specific resources - Implement GetResourceInstances service method in ConnectionService - Add MapConnectionsToInstancePermissions helper for DTO mapping - Implement GetInstances controller endpoint with validation Uses existing AssignmentInstance table as the data source for instance delegations, following the pattern of Connection view for querying.
…ailed permission breakdown for direct and indirect access paths. Key changes: - Add GetInstanceRightsToOthers/FromOthers methods to IConnectionService - Implement GetInstanceRights query method in ConnectionService - Create AssignmentInstanceQueryResult model for instance delegation queries - Query AssignmentInstance table with Direct, KeyRole, and Hierarchy patterns - Add GetInstanceRights controller endpoint with all required parameters - Return ExtInstanceRightDto with DirectRights and IndirectRights arrays - Follow established patterns from GET /resources/rights endpoint Queries support filtering by party relationships and handle access through key roles and entity hierarchy as per acceptance criteria.
…elegations Implements endpoint for delegating rights to specific instances using InstanceRight and InstanceRule models with URN types for isolated instance authorization.
Implements delegation check for instance-specific rights. Returns which rights the authenticated user can delegate to others for a given instance. - Added InstanceCheckDto response model with Resource, Instance, and Rights - Added InstanceDelegationCheck method to IConnectionService/ConnectionService - Activated CheckInstance controller endpoint with required party, resource, and instance parameters - Reuses existing delegation check logic for packages, roles, resources, and access lists
Implements update (replace) operation for instance-specific rights delegation. Unlike POST which adds rules, PUT replaces all existing rules with new ones. - Added UpdateInstance method to IConnectionService/ConnectionService - Calls InstanceDelegationCheck for instance-specific validation - Uses TryWriteInstanceDelegationPolicyRules with ignoreExistingPolicy: true - Activated UpdateInstanceRights controller endpoint with required parameters
Implements deletion of instance-specific rights delegations. Removes only direct delegations between parties for a specific instance, leaving inherited delegations via key roles intact. - Added RemoveInstance method to IConnectionService/ConnectionService - Clears policy rules before removing AssignmentInstances record - Fixed route to DELETE /resources/instances (was incorrectly /resources) - All parameters (party, from, to, resource, instance) are required
Contributor
There was a problem hiding this comment.
Pull request overview
Adds instance-level delegation management to the Enduser Connections API by implementing the previously stubbed PUT/DELETE endpoints.
Changes:
- Implements
PUT /connections/resources/instances/rightsviaIConnectionService.UpdateInstance(...)andConnectionService.UpdateInstance(...). - Implements
DELETE /connections/resources/instancesviaIConnectionService.RemoveInstance(...)andConnectionService.RemoveInstance(...). - Updates
SingleRightsServiceinstance-rule generation to accept more context (from/to/performedBy).
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 6 comments.
| File | Description |
|---|---|
| src/apps/Altinn.AccessManagement/src/Altinn.AccessMgmt.Core/Services/Contracts/IConnectionService.cs | Adds service contract methods for updating/removing instance delegations. |
| src/apps/Altinn.AccessManagement/src/Altinn.AccessMgmt.Core/Services/ConnectionService.cs | Implements update/remove instance delegation logic and wires authorization checks. |
| src/apps/Altinn.AccessManagement/src/Altinn.AccessManagement.Core/Services/SingleRightsService.cs | Extends instance rule generation API to take additional delegation context. |
| src/apps/Altinn.AccessManagement/src/Altinn.AccessManagement.Api.Enduser/Controllers/ConnectionsController.cs | Enables the new instance endpoints by removing the previous NotFound() stubs. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
src/apps/Altinn.AccessManagement/src/Altinn.AccessMgmt.Core/Services/ConnectionService.cs
Show resolved
Hide resolved
Comment on lines
+1245
to
+1249
| public async Task<Result<bool>> UpdateInstance(Entity from, Entity to, Resource resourceObj, string instanceId, IEnumerable<string> rightKeys, Entity by, Action<ConnectionOptions> configureConnection = null, CancellationToken cancellationToken = default) | ||
| { | ||
| var canDelegate = await InstanceDelegationCheck(by.Id, from.Id, resourceObj?.RefId, instanceId, ConfigureConnections, cancellationToken: cancellationToken); | ||
| if (canDelegate.IsProblem) | ||
| { |
Comment on lines
+1253
to
+1261
| foreach (var rightKey in rightKeys) | ||
| { | ||
| if (!canDelegate.Value.Rights.Any(a => a.Right.Key == rightKey && a.Result)) | ||
| { | ||
| return Problems.NotAuthorizedForDelegationRequest; | ||
| } | ||
| } | ||
|
|
||
| List<InstanceRule> result = await singleRightsService.TryWriteInstanceDelegationPolicyRules(from, to, resourceObj, instanceId, rightKeys.ToList(), by, ignoreExistingPolicy: true, cancellationToken: cancellationToken); |
| Task<Result<bool>> AddInstance(Entity from, Entity to, Resource resourceObj, string instanceId, RightKeyListDto rightKeys, Entity by, Action<ConnectionOptions> configureConnection = null, CancellationToken cancellationToken = default); | ||
|
|
||
| /// <summary> | ||
| /// Updates (replaces) a delegation to a resource instance between two entities with the specified action keys. If not all actions is posible nothing is performed and a Problem is returned |
| /// Token to monitor for cancellation requests. | ||
| /// </param> | ||
| /// <returns> | ||
| /// A <see cref="ValidationProblemInstance"/> indicating success or describing any validation errors. |
Comment on lines
+1273
to
+1277
| var resourceObj = await dbContext.Resources.AsNoTracking().FirstOrDefaultAsync(t => t.RefId == resource, cancellationToken); | ||
| if (resourceObj == null) | ||
| { | ||
| return null; | ||
| } |
jonkjetiloye
approved these changes
Mar 17, 2026
Member
jonkjetiloye
left a comment
jonkjetiloye
left a comment
There was a problem hiding this comment.
Kan evt. se over copilot tilbakemeldinger
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Adding functionality for instance delegation to Enduser API ConnectionsController with the following new endpoints:
Related Issue(s)
To be merged in this PR:
PUT /connections/resources/instances/rights- Update instance right delegationDELETE /connections/resources/instances- Remove instance delegationVerification
Documentation