Instance authorization

Altinn.Correspondence.sln

@@ -17,6 +17,8 @@ Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Altinn.Correspondence.Tests
 EndProject
 Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Altinn.Correspondence.Integrations", "src\Altinn.Correspondence.Integrations\Altinn.Correspondence.Integrations.csproj", "{5C88BAAD-CF82-4D7A-8FB6-879605EF4E03}"
 EndProject
+Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Altinn.Correspondence.Common", "src\Altinn.Correspondence.Common\Altinn.Correspondence.Common.csproj", "{AC3CF570-F9E1-4616-A56B-FF94C89CBC0B}"
+EndProject
 Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug|Any CPU = Debug|Any CPU
@@ -47,6 +49,10 @@ Global
 		{5C88BAAD-CF82-4D7A-8FB6-879605EF4E03}.Debug|Any CPU.Build.0 = Debug|Any CPU
 		{5C88BAAD-CF82-4D7A-8FB6-879605EF4E03}.Release|Any CPU.ActiveCfg = Release|Any CPU
 		{5C88BAAD-CF82-4D7A-8FB6-879605EF4E03}.Release|Any CPU.Build.0 = Release|Any CPU
+		{AC3CF570-F9E1-4616-A56B-FF94C89CBC0B}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{AC3CF570-F9E1-4616-A56B-FF94C89CBC0B}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{AC3CF570-F9E1-4616-A56B-FF94C89CBC0B}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{AC3CF570-F9E1-4616-A56B-FF94C89CBC0B}.Release|Any CPU.Build.0 = Release|Any CPU
 	EndGlobalSection
 	GlobalSection(SolutionProperties) = preSolution
 		HideSolutionNode = FALSE

Test/Altinn.Correspondence.Tests/Helpers/MockPolicyEvaluator.cs

@@ -1,5 +1,5 @@
 using Altinn.Common.PEP.Authorization;
-using Altinn.Correspondence.Application.Configuration;
+using Altinn.Correspondence.Common.Constants;
 using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Authorization.Infrastructure;

Test/Altinn.Correspondence.Tests/TestingController/Attachment/Base/AttachmentTestBase.cs

@@ -1,4 +1,4 @@
-using Altinn.Correspondence.Application.Configuration;
+using Altinn.Correspondence.Common.Constants;
 using System.Text.Json;
 
 namespace Altinn.Correspondence.Tests.TestingController.Attachment.Base

Test/Altinn.Correspondence.Tests/TestingController/Correspondence/Base/CorrespondenceTestBase.cs

@@ -1,4 +1,4 @@
-using Altinn.Correspondence.Application.Configuration;
+using Altinn.Correspondence.Common.Constants;
 using System;
 using System.Collections.Generic;
 using System.Linq;

Test/Altinn.Correspondence.Tests/TestingController/Correspondence/CorrespondenceNotificationTests.cs

@@ -1,6 +1,6 @@
 using Altinn.Correspondence.API.Models;
 using Altinn.Correspondence.API.Models.Enums;
-using Altinn.Correspondence.Application.Configuration;
+using Altinn.Correspondence.Common.Constants;
 using Altinn.Correspondence.Core.Models.Notifications;
 using Altinn.Correspondence.Core.Repositories;
 using Altinn.Correspondence.Tests.Factories;

Test/Altinn.Correspondence.Tests/TestingController/Correspondence/CorrespondenceRetrievalTests.cs

@@ -1,6 +1,6 @@
 using Altinn.Correspondence.API.Models;
 using Altinn.Correspondence.API.Models.Enums;
-using Altinn.Correspondence.Application.Configuration;
+using Altinn.Correspondence.Common.Constants;
 using Altinn.Correspondence.Tests.Factories;
 using Altinn.Correspondence.Tests.TestingController.Correspondence.Base;
 using System.Net;

Test/Altinn.Correspondence.Tests/TestingController/Correspondence/CorrespondenceSearchTests.cs

@@ -1,6 +1,6 @@
 using Altinn.Correspondence.API.Models;
 using Altinn.Correspondence.API.Models.Enums;
-using Altinn.Correspondence.Application.Configuration;
+using Altinn.Correspondence.Common.Constants;
 using Altinn.Correspondence.Application.GetCorrespondences;
 using Altinn.Correspondence.Tests.Factories;
 using Altinn.Correspondence.Tests.Helpers;

Test/Altinn.Correspondence.Tests/TestingController/Legacy/Base/LegacyTestBase.cs

@@ -1,4 +1,4 @@
-using Altinn.Correspondence.Application.Configuration;
+using Altinn.Correspondence.Common.Constants;
 using System.Text.Json;
 using System.Text.Json.Serialization;
 

Test/Altinn.Correspondence.Tests/TestingController/Legacy/LegacyDeletionTests.cs

@@ -1,6 +1,6 @@
 using Altinn.Correspondence.API.Models;
 using Altinn.Correspondence.API.Models.Enums;
-using Altinn.Correspondence.Application.Configuration;
+using Altinn.Correspondence.Common.Constants;
 using Altinn.Correspondence.Core.Models.Entities;
 using Altinn.Correspondence.Core.Services;
 using Altinn.Correspondence.Tests.Factories;

Test/Altinn.Correspondence.Tests/TestingController/Legacy/LegacyRetrievalTests.cs

@@ -1,6 +1,6 @@
 using Altinn.Correspondence.API.Models.Enums;
 using Altinn.Correspondence.API.Models;
-using Altinn.Correspondence.Application.Configuration;
+using Altinn.Correspondence.Common.Constants;
 using Altinn.Correspondence.Application.GetCorrespondenceHistory;
 using Altinn.Correspondence.Core.Models.Enums;
 using Altinn.Correspondence.Tests.Factories;

Test/Altinn.Correspondence.Tests/TestingController/Legacy/LegacySearchTests.cs

@@ -1,5 +1,5 @@
 using Altinn.Correspondence.API.Models.Enums;
-using Altinn.Correspondence.Application.Configuration;
+using Altinn.Correspondence.Common.Constants;
 using Altinn.Correspondence.Application.GetCorrespondences;
 using Altinn.Correspondence.Tests.Factories;
 using Altinn.Correspondence.Tests.Helpers;

Test/Altinn.Correspondence.Tests/TestingFeature/DialogportenTests.cs

@@ -1,5 +1,5 @@
 using Altinn.Correspondence.API.Models;
-using Altinn.Correspondence.Application.Configuration;
+using Altinn.Correspondence.Common.Constants;
 using Altinn.Correspondence.Core.Options;
 using Altinn.Correspondence.Core.Repositories;
 using Altinn.Correspondence.Core.Services;

Test/Altinn.Correspondence.Tests/TestingFeature/MalwareScanResultControllerTests.cs

@@ -1,6 +1,6 @@
 using Altinn.Correspondence.API.Models;
 using Altinn.Correspondence.API.Models.Enums;
-using Altinn.Correspondence.Application.Configuration;
+using Altinn.Correspondence.Common.Constants;
 using Altinn.Correspondence.Tests.Helpers;
 using System.Net.Http.Json;
 using System.Text;

Test/Altinn.Correspondence.Tests/TestingFeature/NotificationTests.cs

@@ -1,6 +1,6 @@
 using Altinn.Correspondence.API.Models;
 using Altinn.Correspondence.Application.CheckNotification;
-using Altinn.Correspondence.Application.Configuration;
+using Altinn.Correspondence.Common.Constants;
 using Altinn.Correspondence.Tests.Factories;
 using System.Net.Http.Json;
 using System.Text.Json;

src/Altinn.Correspondence.API/Auth/CascadeAuthenticationHandler.cs

@@ -1,5 +1,5 @@
 using Altinn.Correspondence.API.Auth;
-using Altinn.Correspondence.Application.Configuration;
+using Altinn.Correspondence.Common.Constants;
 using Altinn.Correspondence.Core.Options;
 using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Authentication.JwtBearer;

src/Altinn.Correspondence.API/Auth/DependencyInjection.cs

@@ -1,6 +1,6 @@
 using Altinn.Common.PEP.Authorization;
 using Altinn.Correspondence.API.Helpers;
-using Altinn.Correspondence.Application.Configuration;
+using Altinn.Correspondence.Common.Constants;
 using Altinn.Correspondence.Core.Options;
 using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Authentication.JwtBearer;

src/Altinn.Correspondence.API/Controllers/AttachmentController.cs

@@ -1,6 +1,6 @@
 using Altinn.Correspondence.API.Models;
 using Altinn.Correspondence.Application;
-using Altinn.Correspondence.Application.Configuration;
+using Altinn.Correspondence.Common.Constants;
 using Altinn.Correspondence.Application.DownloadAttachment;
 using Altinn.Correspondence.Application.GetAttachmentDetails;
 using Altinn.Correspondence.Application.GetAttachmentOverview;
@@ -29,7 +29,10 @@ public class AttachmentController(ILogger<CorrespondenceController> logger) : Co
     [Consumes("application/json")]
     [Produces("application/json")]
     [Authorize(Policy = AuthorizationConstants.Sender)]
-    public async Task<ActionResult<Guid>> InitializeAttachment(InitializeAttachmentExt InitializeAttachmentExt, [FromServices] InitializeAttachmentHandler handler, CancellationToken cancellationToken)
+    public async Task<ActionResult<Guid>> InitializeAttachment(
+        InitializeAttachmentExt InitializeAttachmentExt,
+        [FromServices] InitializeAttachmentHandler handler,
+        CancellationToken cancellationToken)
     {
         var commandRequest = InitializeAttachmentMapper.MapToRequest(InitializeAttachmentExt);
         var commandResult = await handler.Process(commandRequest, HttpContext.User, cancellationToken);

src/Altinn.Correspondence.API/Controllers/CorrespondenceController.cs

@@ -2,7 +2,7 @@
 using Altinn.Correspondence.API.Models.Enums;
 using Altinn.Correspondence.Application;
 using Altinn.Correspondence.Application.CheckNotification;
-using Altinn.Correspondence.Application.Configuration;
+using Altinn.Correspondence.Common.Constants;
 using Altinn.Correspondence.Application.DownloadCorrespondenceAttachment;
 using Altinn.Correspondence.Application.GetCorrespondenceDetails;
 using Altinn.Correspondence.Application.GetCorrespondenceOverview;
@@ -103,16 +103,14 @@ public async Task<ActionResult<InitializeCorrespondencesResponseExt>> UploadCorr
         [Authorize(Policy = AuthorizationConstants.SenderOrRecipient, AuthenticationSchemes = AuthorizationConstants.AltinnTokenOrDialogportenScheme)]
         public async Task<ActionResult<CorrespondenceOverviewExt>> GetCorrespondenceOverview(
             Guid correspondenceId,
-            [FromQuery] string? onBehalfOf,
             [FromServices] GetCorrespondenceOverviewHandler handler,
             CancellationToken cancellationToken)
         {
             _logger.LogInformation("Getting Correspondence overview for {correspondenceId}", correspondenceId.ToString());
 
             var commandResult = await handler.Process(new GetCorrespondenceOverviewRequest()
             {
-                CorrespondenceId = correspondenceId,
-                OnBehalfOf = onBehalfOf
+                CorrespondenceId = correspondenceId
             }, HttpContext.User, cancellationToken);
 
             return commandResult.Match(
@@ -134,7 +132,6 @@ public async Task<ActionResult<CorrespondenceOverviewExt>> GetCorrespondenceOver
         [Authorize(Policy = AuthorizationConstants.SenderOrRecipient, AuthenticationSchemes = AuthorizationConstants.AltinnTokenOrDialogportenScheme)]
         public async Task<ActionResult<CorrespondenceDetailsExt>> GetCorrespondenceDetails(
             Guid correspondenceId,
-            [FromQuery] string? onBehalfOf,
             [FromServices] GetCorrespondenceDetailsHandler handler,
             CancellationToken cancellationToken)
         {
@@ -143,7 +140,6 @@ public async Task<ActionResult<CorrespondenceDetailsExt>> GetCorrespondenceDetai
             var commandResult = await handler.Process(new GetCorrespondenceDetailsRequest()
             {
                 CorrespondenceId = correspondenceId,
-                OnBehalfOf = onBehalfOf
             }, HttpContext.User, cancellationToken);
 
             return commandResult.Match(
@@ -239,7 +235,6 @@ public async Task<ActionResult<CorrespondencesExt>> GetCorrespondences(
         [Route("{correspondenceId}/markasread")]
         public async Task<ActionResult> MarkAsRead(
             Guid correspondenceId,
-            [FromQuery] string? onBehalfOf,
             [FromServices] UpdateCorrespondenceStatusHandler handler,
             CancellationToken cancellationToken)
         {
@@ -248,8 +243,7 @@ public async Task<ActionResult> MarkAsRead(
             var commandResult = await handler.Process(new UpdateCorrespondenceStatusRequest
             {
                 CorrespondenceId = correspondenceId,
-                Status = CorrespondenceStatus.Read,
-                OnBehalfOf = onBehalfOf,
+                Status = CorrespondenceStatus.Read
             }, HttpContext.User, cancellationToken);
 
             return commandResult.Match(
@@ -271,7 +265,6 @@ public async Task<ActionResult> MarkAsRead(
         [Route("{correspondenceId}/confirm")]
         public async Task<ActionResult> Confirm(
             Guid correspondenceId,
-            [FromQuery] string? onBehalfOf,
             [FromServices] UpdateCorrespondenceStatusHandler handler,
             CancellationToken cancellationToken)
         {
@@ -280,8 +273,7 @@ public async Task<ActionResult> Confirm(
             var commandResult = await handler.Process(new UpdateCorrespondenceStatusRequest
             {
                 CorrespondenceId = correspondenceId,
-                Status = CorrespondenceStatus.Confirmed,
-                OnBehalfOf = onBehalfOf,
+                Status = CorrespondenceStatus.Confirmed
             }, HttpContext.User, cancellationToken);
 
             return commandResult.Match(
@@ -303,7 +295,6 @@ public async Task<ActionResult> Confirm(
         [Route("{correspondenceId}/archive")]
         public async Task<ActionResult> Archive(
             Guid correspondenceId,
-            [FromQuery] string? onBehalfOf,
             [FromServices] UpdateCorrespondenceStatusHandler handler,
             CancellationToken cancellationToken)
         {
@@ -313,7 +304,6 @@ public async Task<ActionResult> Archive(
             {
                 CorrespondenceId = correspondenceId,
                 Status = CorrespondenceStatus.Archived,
-                OnBehalfOf = onBehalfOf,
             }, HttpContext.User, cancellationToken);
 
             return commandResult.Match(
@@ -332,18 +322,17 @@ public async Task<ActionResult> Archive(
         [HttpDelete]
         [Route("{correspondenceId}/purge")]
         [Authorize(Policy = AuthorizationConstants.SenderOrRecipient)]
+        [EnableCors(AuthorizationConstants.ArbeidsflateCors)]
         public async Task<ActionResult> Purge(
             Guid correspondenceId,
-            [FromQuery] string? onBehalfOf,
             [FromServices] PurgeCorrespondenceHandler handler,
             CancellationToken cancellationToken)
         {
             _logger.LogInformation("Purging Correspondence with id: {correspondenceId}", correspondenceId.ToString());
 
             var commandResult = await handler.Process(new PurgeCorrespondenceRequest()
             {
-                CorrespondenceId = correspondenceId,
-                OnBehalfOf = onBehalfOf
+                CorrespondenceId = correspondenceId
             }, HttpContext.User, cancellationToken);
 
             return commandResult.Match(
@@ -364,15 +353,13 @@ public async Task<ActionResult> Purge(
         public async Task<ActionResult> DownloadCorrespondenceAttachmentData(
             Guid correspondenceId,
             Guid attachmentId,
-            [FromQuery] string? onBehalfOf,
             [FromServices] DownloadCorrespondenceAttachmentHandler handler,
             CancellationToken cancellationToken)
         {
             var commandResult = await handler.Process(new DownloadCorrespondenceAttachmentRequest()
             {
                 CorrespondenceId = correspondenceId,
-                AttachmentId = attachmentId,
-                OnBehalfOf = onBehalfOf
+                AttachmentId = attachmentId
             }, HttpContext.User, cancellationToken);
             return commandResult.Match(
                 result => File(result.Stream, "application/octet-stream", result.FileName),

src/Altinn.Correspondence.API/Controllers/LegacyCorrespondenceController.cs

@@ -1,6 +1,6 @@
 using Altinn.Correspondence.API.Models;
 using Altinn.Correspondence.Application;
-using Altinn.Correspondence.Application.Configuration;
+using Altinn.Correspondence.Common.Constants;
 using Altinn.Correspondence.Application.DownloadCorrespondenceAttachment;
 using Altinn.Correspondence.Application.GetCorrespondenceHistory;
 using Altinn.Correspondence.Application.GetCorrespondenceOverview;

src/Altinn.Correspondence.API/Controllers/MigrationController.cs

@@ -1,6 +1,6 @@
 using Altinn.Correspondence.API.Models;
 using Altinn.Correspondence.Application;
-using Altinn.Correspondence.Application.Configuration;
+using Altinn.Correspondence.Common.Constants;
 using Altinn.Correspondence.Application.GetAttachmentOverview;
 using Altinn.Correspondence.Application.InitializeAttachment;
 using Altinn.Correspondence.Application.InitializeCorrespondence;

src/Altinn.Correspondence.API/Program.cs

@@ -1,6 +1,6 @@
 using Altinn.Correspondence.API.Auth;
 using Altinn.Correspondence.Application;
-using Altinn.Correspondence.Application.Configuration;
+using Altinn.Correspondence.Common.Constants;
 using Altinn.Correspondence.Core.Options;
 using Altinn.Correspondence.Integrations;
 using Altinn.Correspondence.Integrations.Hangfire;

src/Altinn.Correspondence.Application/CancelNotification/CancelNotificationHandler.cs

@@ -1,6 +1,3 @@
-using System.Runtime.CompilerServices;
-using System.Security.Claims;
-using System.Threading;
 using Altinn.Correspondence.Core.Models.Entities;
 using Altinn.Correspondence.Core.Repositories;
 using Altinn.Correspondence.Core.Services;
@@ -10,6 +7,8 @@
 using Microsoft.Extensions.Hosting;
 using Microsoft.Extensions.Logging;
 using Slack.Webhooks;
+using System.Runtime.CompilerServices;
+using System.Security.Claims;
 
 [assembly: InternalsVisibleTo("Altinn.Correspondence.Tests")]
 namespace Altinn.Correspondence.Application.CancelNotification

src/Altinn.Correspondence.Application/DownloadAttachment/DownloadAttachmentHandler.cs

@@ -1,16 +1,14 @@
-using System.Security.Claims;
-using Altinn.Correspondence.Application.Helpers;
-using Altinn.Correspondence.Core.Models.Enums;
+using Altinn.Correspondence.Common.Helpers;
 using Altinn.Correspondence.Core.Repositories;
 using OneOf;
+using System.Security.Claims;
 
 namespace Altinn.Correspondence.Application.DownloadAttachment;
 
 public class DownloadAttachmentHandler(
     IAltinnAuthorizationService altinnAuthorizationService,
     IStorageRepository storageRepository,
-    IAttachmentRepository attachmentRepository,
-    UserClaimsHelper userClaimsHelper) : IHandler<DownloadAttachmentRequest, Stream>
+    IAttachmentRepository attachmentRepository) : IHandler<DownloadAttachmentRequest, Stream>
 {
     public async Task<OneOf<Stream, Error>> Process(DownloadAttachmentRequest request, ClaimsPrincipal? user, CancellationToken cancellationToken)
     {
@@ -19,17 +17,11 @@ public async Task<OneOf<Stream, Error>> Process(DownloadAttachmentRequest reques
         {
             return Errors.AttachmentNotFound;
         }
-        var hasAccess = await altinnAuthorizationService.CheckUserAccess(user, attachment.ResourceId, attachment.Sender, attachment.Id.ToString(), new List<ResourceAccessLevel> { ResourceAccessLevel.Write }, cancellationToken);
+        var hasAccess = await altinnAuthorizationService.CheckAccessAsSender(user, attachment.ResourceId, attachment.Sender.WithoutPrefix(), null, cancellationToken);
         if (!hasAccess)
         {
             return Errors.NoAccessToResource;
         }
-
-        if (!userClaimsHelper.IsSender(attachment.Sender))
-        {
-            return Errors.InvalidSender;
-        }
-
         var attachmentStream = await storageRepository.DownloadAttachment(attachment.Id, cancellationToken);
         return attachmentStream;
     }