Check if XACML action "read" is authorized for dialog FCEs #3428
Description
Introduction
Dialog FCEs (or any parti of dialog.content) is currently subject to any specific XACML check. We need to change this so that the URL gets replaced with "urn:dialogporten:unauthorized" if read is missing, to give a proper hint to clients (arbeidsflate).
Description
See Altinn/altinn-tests#257 (comment) for background.
Implementation
GetDialogDetailsAuthorization and DialogEntityExtensions.GetAltinnActions already always checks if "read" is available. DecorateWithAuthorization will need to be extended to also check for FCEs, likewise ReplaceUnauthorizedUrls.
Tasks
- Extend DecorateWithAuthorization, ReplaceUnauthorizedUrls
- Update documentation
- Add test
Threat Modelling
- I have considered potential security risks (if risks were found, please list them below)
Acceptance criteria
GIVEN ...
WHEN ....
THEN ...
GIVEN ...
WHEN ....
THEN ...