Use ProcessAuthorizer for update data values and presentation texts. (#205)

* Same as PR #948 commit 59201a0e86b1e6ac40a71585b8fea9cd27406079 in Storage.

Author: bjorntore

src/Controllers/Storage/InstancesController.cs

@@ -45,6 +45,7 @@ public class InstancesController : ControllerBase
     private readonly GeneralSettings _generalSettings;
     private readonly IRegisterService _registerService;
     private readonly IApplicationService _applicationService;
+    private readonly IProcessAuthorizer _processAuthorizer;
 
     /// <summary>
     /// Initializes a new instance of the <see cref="InstancesController"/> class
@@ -57,6 +58,7 @@ public class InstancesController : ControllerBase
     /// <param name="registerService">the instance register service.</param>
     /// <param name="applicationService">the application service.</param>
     /// <param name="settings">the general settings.</param>
+    /// <param name="processAuthorizer">the process authorizer.</param>
     public InstancesController(
         IInstanceRepository instanceRepository,
         IPartiesWithInstancesClient partiesWithInstancesClient,
@@ -65,7 +67,8 @@ public InstancesController(
         IInstanceEventService instanceEventService,
         IRegisterService registerService,
         IApplicationService applicationService,
-        IOptions<GeneralSettings> settings
+        IOptions<GeneralSettings> settings,
+        IProcessAuthorizer processAuthorizer
     )
     {
         _instanceRepository = instanceRepository;
@@ -77,6 +80,7 @@ IOptions<GeneralSettings> settings
         _registerService = registerService;
         _applicationService = applicationService;
         _generalSettings = settings.Value;
+        _processAuthorizer = processAuthorizer;
     }
 
     /// <summary>
@@ -911,9 +915,11 @@ await _instanceEventService.DispatchEvent(
     /// <param name="presentationTexts">Collection of changes to the presentation texts collection.</param>
     /// <param name="cancellationToken">CancellationToken</param>
     /// <returns>The instance that was updated with an updated collection of presentation texts.</returns>
-    [Authorize(Policy = AuthzConstants.POLICY_INSTANCE_WRITE)]
+    [Authorize]
     [HttpPut("{instanceOwnerPartyId:int}/{instanceGuid:guid}/presentationtexts")]
     [ProducesResponseType(StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(StatusCodes.Status403Forbidden)]
     [Consumes("application/json")]
     [Produces("application/json")]
     public async Task<ActionResult<Instance>> UpdatePresentationTexts(
@@ -934,6 +940,11 @@ CancellationToken cancellationToken
             cancellationToken
         );
 
+        if (!await _processAuthorizer.AuthorizePresentationTextsUpdate(instance))
+        {
+            return Forbid();
+        }
+
         if (instance.PresentationTexts == null)
         {
             instance.PresentationTexts = new Dictionary<string, string>();
@@ -969,10 +980,11 @@ CancellationToken cancellationToken
     /// <param name="dataValues">Collection of changes to the data values collection.</param>
     /// <param name="cancellationToken">CancellationToken</param>
     /// <returns>The instance that was updated with an updated collection of data values.</returns>
-    [Authorize(Policy = AuthzConstants.POLICY_INSTANCE_WRITE)]
+    [Authorize]
     [HttpPut("{instanceOwnerPartyId:int}/{instanceGuid:guid}/datavalues")]
     [ProducesResponseType(StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(StatusCodes.Status403Forbidden)]
     [Consumes("application/json")]
     [Produces("application/json")]
     public async Task<ActionResult<Instance>> UpdateDataValues(
@@ -993,6 +1005,11 @@ CancellationToken cancellationToken
             cancellationToken
         );
 
+        if (!await _processAuthorizer.AuthorizeDataValuesUpdate(instance))
+        {
+            return Forbid();
+        }
+
         instance.DataValues ??= new Dictionary<string, string>();
 
         List<string> updateProperties = [];

src/Services/Storage/Implementation/ProcessAuthorizer.cs

@@ -2,7 +2,9 @@
 using System;
 using System.Collections.Generic;
 using System.Threading.Tasks;
+using Altinn.Platform.Storage.Configuration;
 using Altinn.Platform.Storage.Interface.Models;
+using Microsoft.Extensions.Options;
 
 namespace Altinn.Platform.Storage.Authorization;
 
@@ -12,13 +14,15 @@ namespace Altinn.Platform.Storage.Authorization;
 public class ProcessAuthorizer : IProcessAuthorizer
 {
     private readonly IAuthorization _authorizationService;
+    private readonly GeneralSettings _settings;
 
     /// <summary>
     /// Initializes a new instance of the <see cref="ProcessAuthorizer"/> class.
     /// </summary>
-    public ProcessAuthorizer(IAuthorization authorizationService)
+    public ProcessAuthorizer(IAuthorization authorizationService, IOptions<GeneralSettings> settings)
     {
         _authorizationService = authorizationService;
+        _settings = settings.Value;
     }
 
     /// <inheritdoc/>
@@ -34,6 +38,13 @@ public Task<bool> AuthorizeProcessNext(Instance instance, ProcessState nextProce
     /// <inheritdoc/>
     public Task<bool> AuthorizeDataElementLock(Instance instance) => Authorize(instance);
 
+    /// <inheritdoc/>
+    public Task<bool> AuthorizePresentationTextsUpdate(Instance instance) => Authorize(instance);
+
+    /// <inheritdoc/>
+    public Task<bool> AuthorizeDataValuesUpdate(Instance instance) =>
+        AuthorizeWithSyncAdapterBypass(instance);
+
     /// <summary>
     /// Get all actions that allow process next for the given task type.
     /// </summary>
@@ -97,4 +108,14 @@ private async Task<bool> Authorize(Instance instance, ProcessState? nextProcessS
 
         return false;
     }
+
+    private Task<bool> AuthorizeWithSyncAdapterBypass(Instance instance)
+    {
+        if (_authorizationService.UserHasRequiredScope(_settings.InstanceSyncAdapterScope))
+        {
+            return Task.FromResult(true);
+        }
+
+        return Authorize(instance);
+    }
 }

src/Services/Storage/Interface/IProcessAuthorizer.cs

@@ -28,4 +28,17 @@ public interface IProcessAuthorizer
     /// Checks the task-type actions plus "reject", since the flow type is not known at lock time.
     /// </summary>
     Task<bool> AuthorizeDataElementLock(Instance instance);
+
+    /// <summary>
+    /// Determines if the user is authorized to update presentation texts.
+    /// Checks the task-type actions plus "reject", since the flow type is not known at update time.
+    /// </summary>
+    Task<bool> AuthorizePresentationTextsUpdate(Instance instance);
+
+    /// <summary>
+    /// Determines if the user is authorized to update data values.
+    /// Checks the task-type actions plus "reject", since the flow type is not known at update time.
+    /// Has a bypass for the sync adapter scope.
+    /// </summary>
+    Task<bool> AuthorizeDataValuesUpdate(Instance instance);
 }