Altinn / Altinn/app-lib-dotnet
Minor bug in policy for older apps
- Dominant language
- C#
- Stars
- 8
- Forks
- 27
- Avg merge
- 1h 21m
- Merged PRs (30d)
- 7
Description
### Description of the bug
Before the simplification of the template policy was made (https://github.com/Altinn/app-template-dotnet/pull/213),
there was a minor bug in [urn:altinn:example:ruleid:3](https://github.com/Altinn/app-template-dotnet/pull/213/files#diff-7561d1e78034702f29d34dc62f2ec0ec2620f9461affd503b3f479cfe5ffc647L146) where the `delete` action attribute, was in the same `` xml node as the resource attributes identifying [ORG] and [APP].
This has probably not caused any functional/authorizational issues which seem to handle it.
But the new feature in ResourceRegistry which deconstructs the policy into all unique rules fails for all older apps with this syntax flaw (see examples below).
### Steps To Reproduce
Example of an app with the flaw:
https://platform.tt02.altinn.no/resourceregistry/api/v1/resource/app_digdir_be-om-api-nokkel/policy/rules
Example of an app where the flaw has been fixed manually:
https://platform.tt02.altinn.no/resourceregistry/api/v1/resource/app_brg_virksomhetsregistrering/policy/rules
### Additional Information
_No response_
Contributor guide
Research direction
Start by reviewing the ResourceRegistry policy-rule deconstruction and compare the older syntax described in PR 213 with the two policy endpoint examples. Done means older app policies with the delete action in the same XACML AnyOf/AllOf node can be deconstructed into unique rules without failure.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- authorization
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100