Added a middleware to capture invalid accesspackage object

[acn-dgopa]

Description

Related Issue(s)

• #{issue number}

Verification

• Your code builds clean without any errors or warnings
• Manual testing done (required)
• Relevant automated test added (if you find this hard, leave it and we'll help out)
• All tests run green

Documentation

• User documentation is updated with a separate linked PR in altinn-studio-docs. (if applicable)

[Copilot]

Pull Request Overview

Adds a middleware that inspects raw JSON payloads for malformed AccessPackage objects and rejects requests containing multiple urn properties.

• Implemented RawJsonInspectionMiddleware to parse and validate JSON bodies on specific endpoints.
• Registered the middleware in the ASP.NET Core pipeline.
• Added unit tests covering valid, invalid, and bypass scenarios.

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
src/Authentication/Middlewares/RawJsonInspectionMiddleware.cs	New middleware to detect and reject AccessPackage objects with duplicate urn properties.
src/Authentication/Program.cs	Registers the new JSON inspection middleware in the request pipeline.
test/Altinn.Platform.Authentication.Tests/Middlewares/RawJsonInspectionMiddlewareTests.cs	Unit tests for valid, invalid, non-JSON, and non-target paths.

Comments suppressed due to low confidence (2)

src/Authentication/Middlewares/RawJsonInspectionMiddleware.cs:89

• There's logic to handle a root JSON array of AccessPackage objects, but no existing test covers this branch. Add a unit test that sends a JSON array at the root to ensure the array-path branch is exercised correctly.

            else if (doc.RootElement.ValueKind == JsonValueKind.Array)

src/Authentication/Program.cs:496

• [nitpick] Consider moving this middleware registration before UseAuthentication() and UseAuthorization() so that malformed JSON returns a 400 response before any authentication or authorization checks run.

    app.UseMiddleware<RawJsonInspectionMiddleware>();

[sonarqubecloud]

Quality Gate passed

Issues
5 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[simen-rekkedal]

LGTM