Expanded GetFiles / File Search with RecipientFileStatus

[RagnarFatland-Avanade]

Description

• Expanded GetFiles / File Search to be able to use RecipientFileStatus s as a search parameter.
• Added new policy for GetFiles to allow it to be used by both Senders and Recipients.
• Updated most policies to be able to handle tokens containing multiple scopes

Related Issue(s)

• Utvid filsøk med RecipientStatus #245

Verification

• Your code builds clean without any errors or warnings
• Manual testing done (required)
• Relevant automated test added (if you find this hard, leave it and we'll help out)
• All tests run green

Documentation

• User documentation is updated with a separate linked PR in altinn-studio-docs. (if applicable)

[RagnarFatland-Avanade]

A case comes in mind; what to do if a user that only has "sender" access attempts to search using RecipientFileStatus?
In the current implementation, they should simply receive an empty search result.
Should we respond with Forbidden?

[Ceredron]

Looks great!

[tomshag]

Looks good.
Maybe I'm blind but does this change include setting default Get request to set RecipientStatus to initialized?

[tomshag]

A case comes in mind; what to do if a user that only has "sender" access attempts to search using RecipientFileStatus? In the current implementation, they should simply receive an empty search result. Should we respond with Forbidden?

If a user only has sender access, should the request not simply ignore RecipientFileStatus if it is supplied?

[RagnarFatland-Avanade]

Looks good. Maybe I'm blind but does this change include setting default Get request to set RecipientStatus to initialized?

Thanks!
The Get should not set any defaults as-is.
I debated with myself if I should set defaults we originally discussed, but found it would obfuscate/limit the search functionality.
The absence of a search parameter indicates that you do not wish to filter on that value/field; overriding that choice with a default seems limiting to me.
We could expand the enums to include a value like "dontFilterOnThis" but seems less intuitive.

[RagnarFatland-Avanade]

A case comes in mind; what to do if a user that only has "sender" access attempts to search using RecipientFileStatus? In the current implementation, they should simply receive an empty search result. Should we respond with Forbidden?

If a user only has sender access, should the request not simply ignore RecipientFileStatus if it is supplied?

I think ignoring a specified filter makes a similar inconsistency that setting default value for non-specified filters; obfuscating the search.
I will leave it as-is until we get some experience with the use.