Extend authorized parties with instance delegations

src/Altinn.AccessManagement.Core/Models/AuthorizedParty/AuthorizedParty.cs

@@ -114,6 +114,11 @@ public AuthorizedParty(SblAuthorizedParty sblAuthorizedParty, bool includeSubuni
     /// </summary>
     public bool OnlyHierarchyElementWithNoAccess { get; set; }
 
+    /// <summary>
+    /// Gets or sets a collection of all Authorized Instances 
+    /// </summary>
+    public List<Resource> AuthorizedInstances { get; set; } = [];
+
     /// <summary>
     /// Gets or sets a collection of all resource identifier the authorized subject has some access to on behalf of this party
     /// </summary>
@@ -158,4 +163,20 @@ private static string MapAppIdToResourceId(string altinnAppId)
 
         return altinnAppId;
     }
+
+    /// <summary>
+    /// Composite Key instances
+    /// </summary>
+    public class Resource
+    {
+        /// <summary>
+        /// Resource ID
+        /// </summary>
+        public string ResourceId { get; set; }
+
+        /// <summary>
+        /// Instance ID
+        /// </summary>
+        public string InstanceId { get; set; }
+    }
 }

src/Altinn.AccessManagement.Core/Repositories/Interfaces/IDelegationMetadataRepository.cs

@@ -29,6 +29,14 @@
     /// <returns>All the last InstanceDelegationChange records stored in the database corresponding to the request</returns>
     Task<List<InstanceDelegationChange>> GetAllLatestInstanceDelegationChanges(InstanceDelegationSource source, string resourceID, string instanceID, CancellationToken cancellationToken = default);
 
+    /// <summary>
+    /// Returns all received instance delegations from db  
+    /// </summary>
+    /// <param name="toUuid">party uuid that received the delegation</param>
+    /// <param name="cancellationToken">The <see cref="CancellationToken"/></param>
+    /// <returns></returns>
+    Task<List<InstanceDelegationChange>> GetAllCurrentReceivedInstanceDelegations(List<Guid> toUuid, CancellationToken cancellationToken = default);
+
     /// <summary>
     /// Returns the last change from db to fetch the current policy version and path to policy file
     /// </summary>
@@ -56,7 +64,7 @@
     /// <param name="toUuid">The receiver uuid</param>
     /// <param name="toUuidType">The type of uuid the reciver is</param>
     /// <param name="cancellationToken">The <see cref="CancellationToken"/></param>
     Task<DelegationChange> GetCurrentDelegationChange(ResourceAttributeMatchType resourceMatchType, string resourceId, int offeredByPartyId, int? coveredByPartyId, int? coveredByUserId, Guid? toUuid, UuidType toUuidType, CancellationToken cancellationToken = default);
 
     /// <summary>
     /// Gets all the delegation change records matching the filter values for a complete changelog

src/Altinn.AccessManagement.Core/Services/AppsInstanceDelegationService.cs

@@ -101,7 +101,7 @@
     private static bool ValidateAndGetSignificantResourcePartsFromResource(IEnumerable<UrnJsonTypeValue> input, out List<UrnJsonTypeValue> resource, string resourceTag)
     {
         resource = new List<UrnJsonTypeValue>();
-        
+
         if (input == null || !input.Any())
         {
             return false;
@@ -185,7 +185,7 @@
 
         if (resource == null)
         {
             errors.Add(ValidationErrors.InvalidResource, "appInstanceDelegationRequest.Resource");
         }
         else
         {
@@ -217,7 +217,7 @@
             return errorResult;
         }
 
         foreach (Right right in delegableRights)
         {
             result.ResourceRightDelegationCheckResults.Add(new()
             {
@@ -307,7 +307,7 @@
         };
         List<RightInternal> rightsAppCantDelegate = new List<RightInternal>();
         UrnJsonTypeValue instanceId = KeyValueUrn.CreateUnchecked($"{AltinnXacmlConstants.MatchAttributeIdentifiers.ResourceInstanceAttribute}:{request.InstanceId}", AltinnXacmlConstants.MatchAttributeIdentifiers.ResourceInstanceAttribute.Length + 1);
-        
+
         foreach (RightInternal rightToDelegate in request.Rights)
         {
             if (CheckIfInstanceIsDelegable(delegableRights, rightToDelegate))
@@ -418,7 +418,7 @@
     {
         foreach (AppsInstanceDelegationResponse item in input)
         {
-            RemoveInstanceIdFromResourceForResponse(item);            
+            RemoveInstanceIdFromResourceForResponse(item);
         }
 
         return input;

src/Altinn.AccessManagement.Core/Services/AuthorizedPartiesService.cs

@@ -164,10 +164,18 @@
         return await Task.FromResult(new List<AuthorizedParty>());
     }
 
+    private async Task<List<InstanceDelegationChange>> GetInstanceDelegations(int subjectUserId, List<int> subjectPartyIds, CancellationToken cancellationToken)
+    {
+        var userId = subjectUserId != 0 ? subjectUserId.SingleToList() : [];
+        userId.AddRange(subjectPartyIds);
+        var parties = await _contextRetrievalService.GetPartiesAsync(userId, false, cancellationToken);
+        return await _delegations.GetAllCurrentReceivedInstanceDelegations(parties.Select(p => (Guid)p.PartyUuid).ToList(), cancellationToken);
+    }
+
     private async Task<List<AuthorizedParty>> BuildAuthorizedParties(int subjectUserId, List<int> subjectPartyIds, bool includeAltinn2AuthorizedParties, bool includeResourcesThroughRoles, CancellationToken cancellationToken)
     {
-        List<AuthorizedParty> result = new();
-        List<AuthorizedParty> a3AuthParties = new();
+        List<AuthorizedParty> result = [];
+        List<AuthorizedParty> a3AuthParties = [];
         SortedDictionary<int, AuthorizedParty> authorizedPartyDict = [];
 
         if ((includeAltinn2AuthorizedParties || includeResourcesThroughRoles) && subjectUserId != 0)
@@ -285,6 +293,30 @@
             authorizedParty.EnrichWithResourceAccess(delegation.ResourceId);
         }
 
+        var instanceDelegations = await GetInstanceDelegations(subjectUserId, subjectPartyIds, cancellationToken);
+        var instanceParties = await _contextRetrievalService.GetPartiesByUuids(instanceDelegations.Select(i => i.FromUuid), false, cancellationToken);
+        foreach (var delegation in instanceDelegations)
+        {
+            if (instanceParties.TryGetValue(delegation.FromUuid.ToString(), out var instanceParty))
+            {
+                throw new UnreachableException($"Get AuthorizedParties failed to lookup party with uuid {delegation.FromUuid} while building instance delegations list");
+            }
+
+            if (authorizedPartyDict.TryGetValue(instanceParty.PartyId, out var authorizedParty))
+            {
+                continue;
+            }
+
+            authorizedParty = new AuthorizedParty(instanceParty);
+            authorizedParty.AuthorizedInstances.Add(new()
+            {
+                InstanceId = delegation.InstanceId,
+                ResourceId = delegation.ResourceId,
+            });
+            authorizedPartyDict.Add(authorizedParty.PartyId, authorizedParty);
+            a3AuthParties.Add(authorizedParty);
+        }
+
         result.AddRange(a3AuthParties);
         return result;
     }
@@ -305,4 +337,4 @@
             }
         }
     }
-}
+}

src/Altinn.AccessManagement.Integration/Clients/AltinnRolesClient.cs

@@ -51,7 +51,7 @@
             _logger.LogError("AccessManagement // AltinnRolesClient // GetDecisionPointRolesForUser // Unexpected HttpStatusCode: {StatusCode}", response.StatusCode);
             return new();
         }
         catch (Exception ex)
         {
             _logger.LogError(ex, "AccessManagement // AltinnRolesClient // GetDecisionPointRolesForUser // Exception");
             throw;
@@ -76,7 +76,7 @@
             _logger.LogError("AccessManagement // AltinnRolesClient // GetRolesForDelegation // Unexpected HttpStatusCode: {StatusCode}", response.StatusCode);
             return new();
         }
         catch (Exception ex)
         {
             _logger.LogError(ex, "AccessManagement // AltinnRolesClient // GetRolesForDelegation // Exception");
             throw;
@@ -102,10 +102,10 @@
             _logger.LogError("AccessManagement // AltinnRolesClient // GetAuthorizedPartiesWithRoles // Unexpected HttpStatusCode: {StatusCode} Response: {Content}", response.StatusCode, content);
             return new();
         }
         catch (Exception ex)
         {
             _logger.LogError(ex, "AccessManagement // AltinnRolesClient // GetAuthorizedPartiesWithRoles // Exception");
             throw;
         }
     }
-}
+}

src/Altinn.AccessManagement.Persistence/DelegationMetadataRepo.cs

@@ -42,7 +42,7 @@ public DelegationMetadataRepo(NpgsqlDataSource conn)
         public async Task<List<DelegationChange>> GetAllAppDelegationChanges(string altinnAppId, int offeredByPartyId, int? coveredByPartyId, int? coveredByUserId, CancellationToken cancellationToken = default)
         {
             using var activity = TelemetryConfig.ActivitySource.StartActivity(ActivityKind.Client);
-            
+
             if (coveredByUserId == null && coveredByPartyId == null)
             {
                 activity?.StopWithError(new ArgumentException($"Both params: {nameof(coveredByUserId)}, {nameof(coveredByPartyId)} cannot be null."));
@@ -60,7 +60,7 @@ FROM delegation.delegationChanges
                     AND coveredByPartyId = @coveredByPartyId
                 ";
             }
-            
+
             if (coveredByUserId != null)
             {
                 query = /*strpsql*/@$"
@@ -335,6 +335,56 @@ public async Task<DelegationChange> InsertDelegation(ResourceAttributeMatchType
             return await InsertResourceRegistryDelegation(delegationChange, cancellationToken);
         }
 
+        /// <summary>
+        ///  Fetches all instance delegated to given param
+        /// </summary>
+        /// <param name="toUuid">list of parties that has received an instance delegation</param>
+        /// <param name="cancellationToken">cancellation token</param>
+        /// <returns></returns>
+        public async Task<List<InstanceDelegationChange>> GetAllCurrentReceivedInstanceDelegations(List<Guid> toUuid, CancellationToken cancellationToken = default)
+        {
+            using var activity = TelemetryConfig.ActivitySource.StartActivity(ActivityKind.Client);
+
+            var query = /*strpsql*/ @"
+                SELECT
+                    instancedelegationchangeid
+                    ,delegationchangetype
+                    ,instanceDelegationMode
+                    ,resourceid
+                    ,instanceid
+                    ,fromuuid
+                    ,fromtype
+                    ,touuid
+                    ,totype
+                    ,performedby
+                    ,performedbytype
+                    ,blobstoragepolicypath
+                    ,blobstorageversionid
+                    ,created
+                FROM 
+                    delegation.instancedelegationchanges
+                    AND delegationchangetype != 'revoke_last'
+                WHERE
+                    touuid = ANY(@toUuid)
+                GROUP BY
+                    resourceid, touuid, fromuuid;
+            ";
+
+            try
+            {
+                await using var cmd = _conn.CreateCommand(query);
+                cmd.Parameters.AddWithValue("toUuid", NpgsqlDbType.Array | NpgsqlDbType.Uuid, toUuid);
+                return await cmd.ExecuteEnumerableAsync(cancellationToken)
+                    .SelectAwait(GetInstanceDelegationChange)
+                    .ToListAsync(cancellationToken);
+            }
+            catch (Exception ex)
+            {
+                activity?.StopWithError(ex);
+                throw;
+            }
+        }
+
         /// <inheritdoc />
         public async Task<InstanceDelegationChange> GetLastInstanceDelegationChange(InstanceDelegationChangeRequest request, CancellationToken cancellationToken = default)
         {
@@ -515,15 +565,15 @@ LatestChanges lc
 
                 return await cmd.ExecuteEnumerableAsync(cancellationToken)
                     .SelectAwait(GetInstanceDelegationChange)
-                    .ToListAsync(cancellationToken);                
+                    .ToListAsync(cancellationToken);
             }
             catch (Exception ex)
             {
                 activity?.StopWithError(ex);
                 throw;
             }
         }
-        
+
         private static async ValueTask<InstanceDelegationChange> GetInstanceDelegationChange(NpgsqlDataReader reader)
         {
             using var activity = TelemetryConfig.ActivitySource.StartActivity();
@@ -682,7 +732,7 @@ FROM insertAction AS ins
             }
         }
 
-        private async Task<DelegationChange> GetCurrentResourceRegistryDelegation(string resourceId, int offeredByPartyId, int? coveredByPartyId, int? coveredByUserId, Guid? toUuid, UuidType toUuidType,  CancellationToken cancellationToken = default)
+        private async Task<DelegationChange> GetCurrentResourceRegistryDelegation(string resourceId, int offeredByPartyId, int? coveredByPartyId, int? coveredByUserId, Guid? toUuid, UuidType toUuidType, CancellationToken cancellationToken = default)
         {
             using var activity = TelemetryConfig.ActivitySource.StartActivity(ActivityKind.Client);
 
@@ -754,7 +804,7 @@ ORDER BY resourceRegistryDelegationChangeId DESC LIMIT 1
                 cmd.Parameters.AddWithNullableValue("coveredByUserId", NpgsqlDbType.Integer, coveredByUserId);
                 cmd.Parameters.AddWithNullableValue(ToUuid, NpgsqlDbType.Uuid, toUuid);
                 cmd.Parameters.AddWithValue(ToType, toUuidType);
-                
+
                 await using var reader = await cmd.ExecuteReaderAsync(cancellationToken);
                 if (await reader.ReadAsync(cancellationToken))
                 {
@@ -980,7 +1030,7 @@ FROM delegation.ResourceRegistryDelegationChanges AS rrdc
                     INNER JOIN res ON rrdc.resourceId_fk = res.resourceid
                 WHERE coveredByPartyId = ANY (@coveredByPartyIds)
             ";
-            
+
             if (offeredByPartyIds != null && offeredByPartyIds.Count > 0)
             {
                 query += /*strpsql*/@"
@@ -1020,7 +1070,7 @@ FROM delegation.ResourceRegistryDelegationChanges AS rr
         public async Task<List<DelegationChange>> GetReceivedResourceRegistryDelegationsForCoveredByUser(int coveredByUserId, List<int> offeredByPartyIds, List<string> resourceRegistryIds = null, List<ResourceType> resourceTypes = null, CancellationToken cancellationToken = default)
         {
             using var activity = TelemetryConfig.ActivitySource.StartActivity(ActivityKind.Client);
-            
+
             if (coveredByUserId < 1)
             {
                 throw new ArgumentException("CoveredByUserId is required");
@@ -1118,7 +1168,7 @@ accessmanagement.Resource AS R
                     AND offeredByPartyId = @offeredByPartyId";
             }
 
-            if (coveredByPartyId > 0) 
+            if (coveredByPartyId > 0)
             {
                 query += /*strpsql*/@"
                     AND coveredByPartyId = @coveredByPartyId";
@@ -1271,7 +1321,7 @@ public async Task<List<DelegationChange>> GetAllDelegationChangesForAuthorizedPa
 
             if (coveredByUserIds == null && coveredByPartyIds == null)
             {
-                return new List<DelegationChange>();
+                return [];
             }
 
             const string query = /*strpsql*/@"
@@ -1427,4 +1477,4 @@ private static async ValueTask<DelegationChange> GetResourceRegistryDelegationCh
             }
         }
     }
-}
+}

src/Altinn.AccessManagement.Persistence/DelegationMetadataRepository.cs

@@ -90,9 +90,9 @@
             await using var pgcom = _conn.CreateCommand(getAllAppDelegationChanges);
 
             pgcom.Parameters.AddWithValue("_altinnAppId", altinnAppId);
             pgcom.Parameters.AddWithValue("_offeredByPartyId", offeredByPartyId);
             pgcom.Parameters.AddWithValue("_coveredByUserId", coveredByUserId.HasValue ? coveredByUserId.Value : DBNull.Value);
             pgcom.Parameters.AddWithValue("_coveredByPartyId", coveredByPartyId.HasValue ? coveredByPartyId.Value : DBNull.Value);
 
             List<DelegationChange> delegationChanges = new List<DelegationChange>();
 
@@ -755,4 +755,10 @@
     {
         throw new NotImplementedException();
     }
+
+    /// <inheritdoc />
+    public Task<List<InstanceDelegationChange>> GetAllCurrentReceivedInstanceDelegations(List<Guid> toUuid, CancellationToken cancellationToken = default)
+    {
+        throw new NotImplementedException();
+    }
 }

src/Altinn.AccessManagement/AccessManagementHost.cs

@@ -104,7 +104,7 @@ private static void ConfigureOpenAPI(this WebApplicationBuilder builder)
                 while (t != null);
                 chain.Reverse();
                 return string.Join(".", chain);
-            };        
+            };
         });
 
         builder.Services.AddUrnSwaggerSupport();

src/Altinn.AccessManagement/Controllers/PolicyInformationPointController.cs

@@ -53,4 +53,4 @@ public async Task<ActionResult<List<DelegationChangeExternal>>> GetAllDelegation
             return _mapper.Map<List<DelegationChangeExternal>>(response.DelegationChanges);
         }
     }
-}
+}

src/Altinn.AccessManagement/Controllers/ResourceOwnerAPI/AppsInstanceDelegationController.cs

@@ -119,8 +119,8 @@ public async Task<ActionResult> Delegation([FromBody] AppsInstanceDelegationRequ
             return Ok(_mapper.Map<AppsInstanceDelegationResponseDto>(serviceResult.Value));
         }
 
-        return StatusCode(StatusCodes.Status206PartialContent, _mapper.Map<AppsInstanceDelegationResponseDto>(serviceResult.Value));        
-    }    
+        return StatusCode(StatusCodes.Status206PartialContent, _mapper.Map<AppsInstanceDelegationResponseDto>(serviceResult.Value));
+    }
 
     /// <summary>
     /// Gets app instance delegation

src/Altinn.AccessManagement/Models/AuthorizedPartyExternal.cs

@@ -63,8 +63,29 @@ public class AuthorizedPartyExternal
     /// </summary>
     public List<string> AuthorizedRoles { get; set; } = [];
 
+    /// <summary>
+    /// Gets or sets a collection of all Authorized Instances 
+    /// </summary>
+    public List<Resource> AuthorizedInstances { get; set; } = [];
+
     /// <summary>
     /// Gets or sets a set of subunits of this party, which the authorized subject also has some access to.
     /// </summary>
     public List<AuthorizedPartyExternal> Subunits { get; set; } = [];
+
+    /// <summary>
+    /// Composite Key instances
+    /// </summary>
+    public class Resource
+    {
+        /// <summary>
+        /// Resource ID
+        /// </summary>
+        public string ResourceId { get; set; }
+
+        /// <summary>
+        /// Instance ID
+        /// </summary>
+        public string InstanceId { get; set; }
+    }
 }