Altinn / Altinn/app-lib-dotnet

Minor bug in policy for older apps

Open
#1,377 0 comments 0 reactions 0 assignees View on GitHub
kind/bug status/triage
Dominant language
C#
Stars
8
Forks
27
Avg merge
1h 21m
Merged PRs (30d)
7

Description

### Description of the bug

Before the simplification of the template policy was made (https://github.com/Altinn/app-template-dotnet/pull/213),
there was a minor bug in [urn:altinn:example:ruleid:3](https://github.com/Altinn/app-template-dotnet/pull/213/files#diff-7561d1e78034702f29d34dc62f2ec0ec2620f9461affd503b3f479cfe5ffc647L146) where the `delete` action attribute, was in the same `` xml node as the resource attributes identifying [ORG] and [APP].

This has probably not caused any functional/authorizational issues which seem to handle it.
But the new feature in ResourceRegistry which deconstructs the policy into all unique rules fails for all older apps with this syntax flaw (see examples below).

### Steps To Reproduce

Example of an app with the flaw:
https://platform.tt02.altinn.no/resourceregistry/api/v1/resource/app_digdir_be-om-api-nokkel/policy/rules

Example of an app where the flaw has been fixed manually:
https://platform.tt02.altinn.no/resourceregistry/api/v1/resource/app_brg_virksomhetsregistrering/policy/rules

### Additional Information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the ResourceRegistry policy-rule deconstruction and compare the older syntax described in PR 213 with the two policy endpoint examples. Done means older app policies with the delete action in the same XACML AnyOf/AllOf node can be deconstructed into unique rules without failure.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
authorization
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.