Altinn / Altinn/app-lib-dotnet

Get data API call does not take app information into account when responding

Open
#64 0 comments 0 reactions 0 assignees View on GitHub
kind/bug
Dominant language
C#
Stars
8
Forks
27
Avg merge
1h 21m
Merged PRs (30d)
7

Description

### Description of the bug

It is possible to look up instance data from a different app and it will be serialized into the wrong model

### Steps To Reproduce

Prerequisites:

- A valid API token
- Two apps (APP1, APP2) with different models

How to reproduce:

1. Create an instance in the altinn3 gui on **APP1**
2. Identify the needed information by inspecting network or lookup in API (org, APP1, APP2, partyid, instanceid, dataid)
4. Do a GET request to https://{org}.apps.tt02.altinn.no/{org}/**{APP2]**/instances/{partyId}/{instanceId}/data/{dataId}
5. Observe that you get 200 OK and the wrong model

Expected result:

404 Not found

### Additional Information

_No response_

Contributor guide

Open the contributing guide

Research direction

Reproduce the GET request against APP1 and APP2 using the endpoint and prerequisites in the issue, confirming whether APP2 returns APP1 data with 200 OK. Trace that request through app-lib-dotnet's API handling; done means a cross-app lookup returns 404 Not Found instead of serializing the data into the wrong model.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
api, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.