RRR Admin CRUD

[TheTechArch]

Description

We need an API to let resource owners administrate the resource rights registry.

As a service owner, you can add, remove, or update rights for a given organization/person for a given resource.

This data will be used in PDP to deny/allow access to a resource that has enabled RRR.

It will also disable access to delegating rights relegated to resources.

Model

{
"RRRID": "9726e418-911e-4c55-a2e5-186446fa0b7c"
"Resource": "urn:altinn:resource:skd_skattemelding,
"PartyID": 1234325,
"Party": "orgno:923488",
"Action": ["Read","Write"],
"RequiredClaim": "urn:scope:flyttemelding"
}

Additional Information

When adding rights to a resource, the API needs to verify that.

• Authenticated org has scope for resource registry
• Authenticated org owns the resource in question
• Verify that the resource has enabled RRR
• Find the correct party and add it to row for performance lookup
• When deleting a row, we need to add it do a history tabell

Tasks

Beta Give feedback

1. Setup ResourceRegistry Controller
2. Setup Resource Registry Database
3. Setup Controller authorization
4. Create Service layer
5. Create and handle optimistic concurrency to the database
6. Create a method to create an entry to RRR
7. Create a method to delete entries to RRR based on ID
8. Add list of resource connections to access list info DTO (nullable)
9. Integrate with registry to exchange party-guids for organization numbers
10. Provide error codes to frontend (RRR) #418
    kind/task +1
    

API methods

Beta Give feedback

1. GET /resourceregistry/api/v1/access-lists/{owner}
2. GET /resourceregistry/api/v1/access-lists/{owner}/{identifier}
3. DELETE /resourceregistry/api/v1/access-lists/{owner}/{identifier}
4. PUT /resourceregistry/api/v1/access-lists/{owner}/{identifier}
5. PATCH /resourceregistry/api/v1/access-lists/{owner}/{identifier} #417
   kind/task +1
6. GET /resourceregistry/api/v1/access-lists/{owner}/{identifier}/members
7. PUT /resourceregistry/api/v1/access-lists/{owner}/{identifier}/members
8. POST /resourceregistry/api/v1/access-lists/{owner}/{identifier}/members
9. DELETE /resourceregistry/api/v1/access-lists/{owner}/{identifier}/members
10. GET /resourceregistry/api/v1/access-lists/{owner}/{identifier}/resource-connections
11. PUT /resourceregistry/api/v1/access-lists/{owner}/{identifier}/resource-connections/{resourceIdentifier}
12. DELETE /resourceregistry/api/v1/access-lists/{owner}/{identifier}/resource-connections/{resourceIdentifier}
13. GET /resourceregistry/api/v1/access-lists/memberships #416
    kind/task +1
    

Known bugs

Beta Give feedback

1. Trying to insert a resource-connection to a resource that does not exist returns a 500 error due to a database violation #421
   kind/task +1

Acceptance Criteria

• Service Owners can add RRR data only for resources owned by them
• Service owner can modify RRR data only for resources owned by them
• Only orgs with write scope to resource registry is allowed to access RRR api

Related

• Allow getting party-information from org.nr in bulk altinn-register#170

[Alxandr]

Related: Altinn/altinn-register#180