remove isRecipient check because user can have delegated permissions (#…

…457)
Altinn · Nov 7, 2024 · deeb1d9 · deeb1d9
1 parent 2c778b7
commit deeb1d9
Show file tree

Hide file tree

Showing 3 changed files with 4 additions and 12 deletions.
diff --git a/...ication/DownloadCorrespondenceAttachment/LegacyDownloadCorrespondenceAttachmentHandler.cs b/...ication/DownloadCorrespondenceAttachment/LegacyDownloadCorrespondenceAttachmentHandler.cs
@@ -38,7 +38,7 @@ public async Task<OneOf<DownloadCorrespondenceAttachmentResponse, Error>> Proces
         {
             return Errors.CouldNotFindOrgNo;
         }
-
+        // TODO: Authorize party
         var correspondence = await _correspondenceRepository.GetCorrespondenceById(request.CorrespondenceId, true, false, cancellationToken);
         if (correspondence is null)
         {
@@ -49,11 +49,6 @@ public async Task<OneOf<DownloadCorrespondenceAttachmentResponse, Error>> Proces
         {
             return Errors.AttachmentNotFound;
         }
-        bool isRecipient = correspondence.Recipient == ("0192:"+party.OrgNumber) || correspondence.Recipient == party.SSN;
-        if (!isRecipient)
-        {
-            return Errors.CorrespondenceNotFound;
-        }
         var latestStatus = correspondence.GetLatestStatus();
         if (!latestStatus.Status.IsAvailableForRecipient())
         {

diff --git a/...respondence.Application/GetCorrespondenceHistory/LegacyGetCorrespondenceHistoryHandler.cs b/...respondence.Application/GetCorrespondenceHistory/LegacyGetCorrespondenceHistoryHandler.cs
@@ -33,6 +33,7 @@ public async Task<OneOf<LegacyGetCorrespondenceHistoryResponse, Error>> Process(
         {
             return Errors.CouldNotFindOrgNo;
         }
+        // TODO: Authorize party
         var correspondence = await _correspondenceRepository.GetCorrespondenceById(correspondenceId, true, true, cancellationToken);
         if (correspondence is null)
         {
@@ -46,7 +47,7 @@ public async Task<OneOf<LegacyGetCorrespondenceHistoryResponse, Error>> Process(
         var minimumAuthLevel = await _altinnAuthorizationService.CheckUserAccessAndGetMinimumAuthLevel(correspondence.ResourceId, new List<ResourceAccessLevel> { ResourceAccessLevel.Read }, cancellationToken);
         if (minimumAuthLevel is not int authenticationLevel)
         {
-            authenticationLevel = 2;
+            authenticationLevel = 2; // TODO: Remove when authorization is implemented
             // return Errors.LegacyNoAccessToCorrespondence;
         }
 

diff --git a/...ondence.Application/UpdateCorrespondenceStatus/LegacyUpdateCorrespondenceStatusHandler.cs b/...ondence.Application/UpdateCorrespondenceStatus/LegacyUpdateCorrespondenceStatusHandler.cs
@@ -39,16 +39,12 @@ public async Task<OneOf<Guid, Error>> Process(UpdateCorrespondenceStatusRequest
         {
             return Errors.CouldNotFindOrgNo;
         }
+        // TODO: Authorize party
         var correspondence = await _correspondenceRepository.GetCorrespondenceById(request.CorrespondenceId, true, false, cancellationToken);
         if (correspondence == null)
         {
             return Errors.CorrespondenceNotFound;
         }
-        bool isRecipient = correspondence.Recipient == ("0192:" + party.OrgNumber) || correspondence.Recipient == party.SSN;
-        if (!isRecipient)
-        {
-            return Errors.CorrespondenceNotFound;
-        }
         var currentStatus = correspondence.GetLatestStatus();
         if (currentStatus is null)
         {