Altinn
diff --git a/‎Directory.Packages.props‎
Lines changed: 1 addition & 1 deletion b/‎Directory.Packages.props‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎doc/adr/001-signing-interface.md‎
Lines changed: 42 additions & 0 deletions b/‎doc/adr/001-signing-interface.md‎
Lines changed: 42 additions & 0 deletions
diff --git a/‎doc/adr/002-signing-transaction-handling.md‎
Lines changed: 58 additions & 0 deletions b/‎doc/adr/002-signing-transaction-handling.md‎
Lines changed: 58 additions & 0 deletions
diff --git a/‎doc/adr/template.md‎
Lines changed: 45 additions & 0 deletions b/‎doc/adr/template.md‎
Lines changed: 45 additions & 0 deletions
diff --git a/‎src/Altinn.App.Api/Altinn.App.Api.csproj‎
Lines changed: 1 addition & 0 deletions b/‎src/Altinn.App.Api/Altinn.App.Api.csproj‎
Lines changed: 1 addition & 0 deletions
diff --git a/‎src/Altinn.App.Api/Controllers/ActionsController.cs‎
Lines changed: 5 additions & 2 deletions b/‎src/Altinn.App.Api/Controllers/ActionsController.cs‎
Lines changed: 5 additions & 2 deletions
diff --git a/‎src/Altinn.App.Api/Controllers/ProcessController.cs‎
Lines changed: 41 additions & 44 deletions b/‎src/Altinn.App.Api/Controllers/ProcessController.cs‎
Lines changed: 41 additions & 44 deletions
@@ -9,7 +9,7 @@
     <PackageVersion Include="Altinn.Common.EFormidlingClient" Version="1.3.3" />
     <PackageVersion Include="Altinn.Common.PEP" Version="4.1.2" />
     <PackageVersion Include="Altinn.Platform.Models" Version="1.6.1" />
-    <PackageVersion Include="Altinn.Platform.Storage.Interface" Version="4.0.6" />
+    <PackageVersion Include="Altinn.Platform.Storage.Interface" Version="4.0.10" />
     <PackageVersion Include="Azure.Extensions.AspNetCore.Configuration.Secrets" Version="1.4.0" />
     <PackageVersion Include="Azure.Identity" Version="1.13.2" />
     <PackageVersion Include="Azure.Monitor.OpenTelemetry.Exporter" Version="1.3.0" />
 
@@ -0,0 +1,42 @@
+# Internal handling of the signing interface
+
+-   Status: Proposed
+-   Deciders: Johannes Haukland, Bjørn Tore on behalf of Team Apps
+-   Date: 2024-09-25
+
+## Result
+
+Chosen alternative A2: Unlimited implementations per app.
+
+## Problem context
+
+Apps will expose an interface to app developers for signing logic. The implementation of the interface will
+contain logic which derives the relevant signees in the application context.
+
+## Decision drivers
+
+-   B1: Support multiple signees per process task.
+-   B2: Support runtime signees decision for app end users.
+-   B3: Support different signees for different process tasks.
+-   B4: It should be clear how to implement in Altinn Studio.
+-   B5: Nice to have: Keep complexity for app developers low.
+
+## Alternatives considered
+
+-   A1: Maximum one implementation of the interface per app.
+-   A2: Unlimited implementations per app, process task connected to implementation id with `</altinn:signLogicId>` in `<altinn:signatureConfig>`
+
+## Pros and cons
+
+### A1
+
+-   Good, because B1, B2 and B3 is supported.
+-   Bad, because the implementation of the interface must include paths for different tasks to support B3. This undermines B5
+-   Bad, because the implementation in Altinn studio would be complex
+    -   Adding another signing task would require Studio to append a conditional path to the existing interface implementation
+
+### A2
+
+-   Good, because B1, B2 and B3 is supported.
+-   Good, because implementation for studio is trivial, supporting B4.
+-   Bad, because more process configuration is required to support B3. This undermines B5
@@ -0,0 +1,58 @@
+# How we handle transactions for signing
+
+-   Status: Proposed
+-   Deciders: Johannes Haukland, Bjørn Tore on behalf of Team Apps
+-   Date: 02.10.2024
+
+## Result
+
+A2: State - We store transaction state. We retry, skipping the previously succesful steps.
+
+## Problem context
+
+When we talk about a transaction in this context we mean several ordered steps.
+We use two categories to describe a step in the context of a transaction:
+
+1. Idempotent - Completing the step multiple times has the same effect as doing it once
+   Example: Assigning a role to a person.
+2. Non-Idempotent
+   Example: Sending a notification to a person.
+
+In the case of signing we have two transactions:
+
+#### Setting signees transaction
+
+1. Delegate right to action **sign** on the signing task.
+2. Send a notification to the signee using the correspondence API
+
+#### Signing
+
+1. A signee signs data elements
+2. The person in charge of moving the process out of the sign task is notified using the correspondence API
+
+We will refer to step 1 as the **action** and step 2 as the **message**
+
+## Decision drivers
+
+-   B1: We must not send a **message** unless the **action** is successful
+-   B2: We must guarantee "at least once delivery" of the **message** if the **action** is successful
+-   B3: We should guarantee "exactly once delivery" of the **message** if the **action** is successful
+-   B4: We should not rollback idempotent steps if they are to be redone.
+
+## Alternatives considered
+
+-   A1: Rollback - We use a transaction scope. If a step fails then we rollback the previous steps. We retry the transction.
+-   A2: State - We store transaction state. We retry, skipping the previously succesful steps.
+
+## Pros and cons
+
+List the pros and cons with the alternatives. This should be in regards to the decision drivers.
+
+### A1
+
+-   Good, because this alternative adheres to all descision drivers
+-   Bad, because it does not fullfill the B4 decision driver, leading to unnecessary traffic.
+
+### A2
+
+-   Good, because it adheres to all **must** decision drivers.
@@ -0,0 +1,45 @@
+# A short descriptive title - what is the outcome of this adr?
+
+-   Status: Proposed | Accepted | Exceeded by "adr-name"
+-   Deciders: People | Team
+-   Date: Proposal date
+
+## Result
+
+Which alternative was chosen. Do not include any reasoning here.
+
+## Problem context
+
+The problem you want to solve, any relevant context.
+
+## Decision drivers
+
+A list of decision drivers. These are points which can differ in importance. If a point is "nice to have" rather than
+"need to have", then prefix the description.
+
+Examples
+
+-   B1: The solution make it easier for app developers to develop an app.
+-   B2: Nice to have: The solution should be simple to implement for out team.
+
+## Alternatives considered
+
+List the alternatives that were considered as a solution to the problem context.
+
+-   A1: A solution to the problem.
+-   A2: Another solution to the problem
+
+## Pros and cons
+
+List the pros and cons with the alternatives. This should be in regards to the decision drivers.
+
+### A1
+
+-   Good, because this alternative adheres to B1.
+    -   Optional explanation as to how.
+-   Bad, because it does not fullfill the B2 decision driver.
+
+### A2
+
+-   Good, because this alternative adheres to B2.
+-   Bad, because it does not fullfill the B1 decision driver.
@@ -11,6 +11,7 @@
 
     <!-- SonarCloud requires a ProjectGuid to separate projects. -->
     <ProjectGuid>{E8F29FE8-6B62-41F1-A08C-2A318DD08BB4}</ProjectGuid>
+    <DebugType>portable</DebugType>
   </PropertyGroup>
 
   <ItemGroup>
 
@@ -60,6 +60,7 @@ IAuthenticationContext authenticationContext
     /// <param name="instanceOwnerPartyId">unique id of the party that this the owner of the instance</param>
     /// <param name="instanceGuid">unique id to identify the instance</param>
     /// <param name="actionRequest">user action request</param>
+    /// <param name="ct">Cancellation token, populated by the framework</param>
     /// <param name="language">The currently used language by the user (or null if not available)</param>
     /// <returns><see cref="UserActionResponse"/></returns>
     [HttpPost]
@@ -75,6 +76,7 @@ public async Task<ActionResult<UserActionResponse>> Perform(
         [FromRoute] int instanceOwnerPartyId,
         [FromRoute] Guid instanceGuid,
         [FromBody] UserActionRequest actionRequest,
+        CancellationToken ct,
         [FromQuery] string? language = null
     )
     {
@@ -134,7 +136,8 @@ public async Task<ActionResult<UserActionResponse>> Perform(
             actionRequest.ButtonId,
             actionRequest.Metadata,
             language,
-            currentAuth
+            currentAuth,
+            actionRequest.OnBehalfOf
         );
         IUserAction? actionHandler = _userActionService.GetActionHandler(action);
         if (actionHandler is null)
@@ -152,7 +155,7 @@ public async Task<ActionResult<UserActionResponse>> Perform(
             );
         }
 
-        UserActionResult result = await actionHandler.HandleAction(userActionContext);
+        UserActionResult result = await actionHandler.HandleAction(userActionContext, ct);
 
         if (result.ResultType is ResultType.Failure)
         {
 
@@ -10,8 +10,8 @@
 using Altinn.App.Core.Internal.Process.Elements;
 using Altinn.App.Core.Internal.Process.Elements.AltinnExtensionProperties;
 using Altinn.App.Core.Internal.Validation;
-using Altinn.App.Core.Models;
 using Altinn.App.Core.Models.Process;
+using Altinn.App.Core.Models.UserAction;
 using Altinn.App.Core.Models.Validation;
 using Altinn.Platform.Storage.Interface.Models;
 using Microsoft.AspNetCore.Authorization;
@@ -40,6 +40,7 @@ public class ProcessController : ControllerBase
     private readonly IProcessEngine _processEngine;
     private readonly IProcessReader _processReader;
     private readonly InstanceDataUnitOfWorkInitializer _instanceDataUnitOfWorkInitializer;
+    private readonly IProcessEngineAuthorizer _processEngineAuthorizer;
 
     /// <summary>
     /// Initializes a new instance of the <see cref="ProcessController"/>
@@ -52,7 +53,8 @@ public ProcessController(
         IAuthorizationService authorization,
         IProcessReader processReader,
         IProcessEngine processEngine,
-        IServiceProvider serviceProvider
+        IServiceProvider serviceProvider,
+        IProcessEngineAuthorizer processEngineAuthorizer
     )
     {
         _logger = logger;
@@ -63,6 +65,7 @@ IServiceProvider serviceProvider
         _processReader = processReader;
         _processEngine = processEngine;
         _instanceDataUnitOfWorkInitializer = serviceProvider.GetRequiredService<InstanceDataUnitOfWorkInitializer>();
+        _processEngineAuthorizer = processEngineAuthorizer;
     }
 
     /// <summary>
@@ -275,6 +278,7 @@ [FromRoute] Guid instanceGuid
     /// <param name="app">application identifier which is unique within an organisation</param>
     /// <param name="instanceOwnerPartyId">unique id of the party that is the owner of the instance</param>
     /// <param name="instanceGuid">unique id to identify the instance</param>
+    /// <param name="ct">Cancellation token, populated by the framework</param>
     /// <param name="elementId">obsolete: alias for action</param>
     /// <param name="language">Signal the language to use for pdf generation, error messages...</param>
     /// <param name="processNext">The body of the request containing possible actions to perform before advancing the process</param>
@@ -287,6 +291,7 @@ public async Task<ActionResult<AppProcessState>> NextElement(
         [FromRoute] string app,
         [FromRoute] int instanceOwnerPartyId,
         [FromRoute] Guid instanceGuid,
+        CancellationToken ct,
         [FromQuery] string? elementId = null,
         [FromQuery] string? language = null,
         [FromBody] ProcessNext? processNext = null
@@ -329,16 +334,7 @@ public async Task<ActionResult<AppProcessState>> NextElement(
                 );
             }
 
-            string checkedAction = EnsureActionNotTaskType(processNext?.Action ?? altinnTaskType);
-
-            bool authorized = await AuthorizeAction(
-                checkedAction,
-                org,
-                app,
-                instanceOwnerPartyId,
-                instanceGuid,
-                currentTaskId
-            );
+            bool authorized = await _processEngineAuthorizer.AuthorizeProcessNext(instance, processNext?.Action);
 
             if (!authorized)
             {
@@ -347,22 +343,47 @@ public async Task<ActionResult<AppProcessState>> NextElement(
                     new ProblemDetails()
                     {
                         Status = StatusCodes.Status403Forbidden,
-                        Detail = $"User is not authorized to perform action {checkedAction} on task {currentTaskId}",
+                        Detail =
+                            $"User is not authorized to perform process next. Task ID: {currentTaskId}. Task type: {altinnTaskType}. Action: {processNext?.Action ?? "none"}.",
                         Title = "Unauthorized",
                     }
                 );
             }
 
-            _logger.LogDebug("User is authorized to perform action {Action}", checkedAction);
+            _logger.LogDebug(
+                "User successfully authorized to perform process next. Task ID: {CurrentTaskId}. Task type: {AltinnTaskType}. Action: {ProcessNextAction}.",
+                currentTaskId,
+                altinnTaskType,
+                LogSanitizer.Sanitize(processNext?.Action ?? "none")
+            );
+
+            string checkedAction = processNext?.Action ?? ConvertTaskTypeToAction(altinnTaskType);
 
             var request = new ProcessNextRequest()
             {
                 Instance = instance,
                 User = User,
                 Action = checkedAction,
+                ActionOnBehalfOf = processNext?.ActionOnBehalfOf,
                 Language = language,
             };
 
+            if (processNext?.Action is not null)
+            {
+                UserActionResult userActionResult = await _processEngine.HandleUserAction(request, ct);
+                if (userActionResult.ResultType is ResultType.Failure)
+                {
+                    var failedUserActionResult = new ProcessChangeResult()
+                    {
+                        Success = false,
+                        ErrorMessage = $"Action handler for action {request.Action} failed!",
+                        ErrorType = userActionResult.ErrorType,
+                    };
+
+                    return GetResultForError(failedUserActionResult);
+                }
+            }
+
             // If the action is 'reject' the task is being abandoned, and we should skip validation, but only if reject has been allowed for the task in bpmn.
             if (checkedAction == "reject" && _processReader.IsActionAllowedForTask(currentTaskId, checkedAction))
             {
@@ -521,17 +542,9 @@ instance.Process.EndEvent is null
             && counter++ < MaxIterationsAllowed
         )
         {
-            string altinnTaskType = EnsureActionNotTaskType(instance.Process.CurrentTask.AltinnTaskType);
+            bool authorizeProcessNext = await _processEngineAuthorizer.AuthorizeProcessNext(instance);
 
-            bool authorized = await AuthorizeAction(
-                altinnTaskType,
-                org,
-                app,
-                instanceOwnerPartyId,
-                instanceGuid,
-                instance.Process.CurrentTask.ElementId
-            );
-            if (!authorized)
+            if (!authorizeProcessNext)
             {
                 return Forbid();
             }
@@ -552,7 +565,7 @@ instance.Process.EndEvent is null
                 {
                     Instance = instance,
                     User = User,
-                    Action = altinnTaskType,
+                    Action = ConvertTaskTypeToAction(instance.Process.CurrentTask.AltinnTaskType),
                     Language = language,
                 };
                 var result = await _processEngine.Next(request);
@@ -704,30 +717,12 @@ private ObjectResult ExceptionResponse(Exception exception, string message)
         );
     }
 
-    private async Task<bool> AuthorizeAction(
-        string action,
-        string org,
-        string app,
-        int instanceOwnerPartyId,
-        Guid instanceGuid,
-        string? taskId = null
-    )
-    {
-        return await _authorization.AuthorizeAction(
-            new AppIdentifier(org, app),
-            new InstanceIdentifier(instanceOwnerPartyId, instanceGuid),
-            HttpContext.User,
-            action,
-            taskId
-        );
-    }
-
     private async Task<List<UserAction>> AuthorizeActions(List<AltinnAction> actions, Instance instance)
     {
         return await _authorization.AuthorizeActions(instance, HttpContext.User, actions);
     }
 
-    private static string EnsureActionNotTaskType(string actionOrTaskType)
+    private static string ConvertTaskTypeToAction(string actionOrTaskType)
     {
         switch (actionOrTaskType)
         {
@@ -736,6 +731,8 @@ private static string EnsureActionNotTaskType(string actionOrTaskType)
                 return "write";
             case "confirmation":
                 return "confirm";
+            case "signing":
+                return "sign";
             default:
                 // Not any known task type, so assume it is an action type
                 return actionOrTaskType;