Expose a EU endpoints that proxies for authorized parties

[elsand]

Introduction

We should make available a list of authorized parties over the EU API

Description

As of now, any Dialogporten consumer will have to make a separate integration to Access Management APIs in order to get valid values to put into Party. This is non-obvious, and a hinderance for adoption. Dialogporten will also need to intergrate this API in order to do search authorization, and will have this information cached. It therefore makes sense to expose a new endpoint over the EU API that can expose a custom DTO for authorized parties.

Considerations

• Expose in GQL? Yes, included in PR.
• Make available to SOs?

Implementation

This should use the same client and cache as will be required in #42. It is desirable for the consuming APIs to determine whether or not the current user has any special rights for each of the parties (key role, HADM ("hovedadministrator"), ADMAI ("tilgangsstyrer")), so that any GUI related to access management can rely on that information. Suggested DTO:

{
  "authorizedParties": [
    {
      "name": "NAVN PÅ AVGIVER",
      "type": "Organization", // or "Person"
      "identifier": "urn:altinn:organization:identifier-no::912345678",
      "isDeleted": true,
      "hasKeyRole": true,
      "isMainAdmin": true,
      "isAccessManager": true,
      "subParties": [ /* nullable, includes any nested parties */ ]
    },
    {
      "name": "NAVN PÅ AVGIVER",
      "type": "Person", // or "Person"
      "identifier": "urn:altinn:person:identifier-no::912345678",
      "isDeleted": true,
      "hasKeyRole": true,
      "isMainAdmin": true,
      "isAccessManager": true
    }
  ]
}

Tasks

Preview Give feedback

1. Add endpoint
2. Add handler
3. Add application service for IUser and access management client
4. Add application external for access management client
5. Add access management client