Add name property to API actions

[elsand]

Introduction

This adds a name property to API-actions, which can be used by EUS-es to navigate to the correct action without looking at the URL

Description

Often there are distinct actions that require the same XACML action to be authorized, eg. correspondence:

"apiActions": [
        {
            "id": "01956b2c-59db-720c-a7c7-89cb924f3a75",
            "action": "read",
            "isAuthorized": "true",
            "endpoints": [
                {
                    "id": "01956b2c-59db-720c-a76e-20f369c8b64b",
                    "version": "v1",
                    "url": "https://platform.tt02.altinn.no/correspondence/api/v1/correspondence/01956b2c-55bd-77fb-89ce-8c4a80f85fdc",
                    "httpMethod": "GET",
                    "deprecated": false
                }
            ]
        },
        {
            "id": "01956b2c-59db-720c-a796-c2cfcfdd5d9f",
            "action": "write",
            "isAuthorized": true,
            "endpoints": [
                {
                    "id": "01956b2c-59db-720c-a7a2-74ba1b2eba4f",
                    "url": "https://platform.tt02.altinn.no/correspondence/api/v1/correspondence/01956b2c-55bd-77fb-89ce-8c4a80f85fdc/confirm",
                    "httpMethod": "POST",
                    "deprecated": false
                }
            ]
        },        
        {
            "id": "01956b2c-59db-720c-a7c2-26201abbf8f0",
            "action": "write",
            "isAuthorized": true,
            "endpoints": [
                {
                    "id": "01956b2c-59db-720c-a7cc-dee5473ba96f",
                    "url": "https://platform.tt02.altinn.no/correspondence/api/v1/correspondence/01956b2c-55bd-77fb-89ce-8c4a80f85fdc/purge",
                    "httpMethod": "DELETE",
                    "deprecated": false
                }
            ]
        },
        {
            "id": "01956b2c-59db-720c-a7d0-b43baadec8ad",
            "action": "write",
            "isAuthorized": true,
            "endpoints": [
                {
                    "id": "01956b2c-59db-720c-a7d7-3c94d09b19f3",
                    "url": "https://platform.tt02.altinn.no/correspondence/api/v1/correspondence/01956b2c-55bd-77fb-89ce-8c4a80f85fdc/markasread",
                    "httpMethod": "POST",
                    "deprecated": false
                }
            ]
        }        
    ]

Currently, the only way for a system to differentiate the various write-actions is to look at the URL, which we want to avoid. By adding a optional "name"-property, which can be the logical name for the apiAction, this can be remedied.

Tasks

• Add nullable field to entity
• DB migration
• Add nullable name property to all DTOs
• Add validation (standard max 255 chars, if supplied)

Threat Modelling

• I have considered potential security risks (if risks were found, please list them below)

Acceptance criteria

GIVEN an API action with a name value
WHEN the API action is retrieved
THEN the name value should be returned in the response

GIVEN a request to create or update an API action with a name value
WHEN the name value is 255 characters or less
THEN the API action should be created or updated with the provided name

GIVEN a request to create or update an API action with a name value
WHEN the name value exceeds 255 characters
THEN the request should be rejected with an appropriate validation error

GIVEN a request to create or update an API action without a name value
WHEN the API action is processed
THEN the API action should be created or updated with a null name value

[LeifHelstad]

Test

TC-100 + TC-200

🟢 ser i utgangspunktet bra ut

Dekker disse:

GIVEN an API action with a name value
WHEN the API action is retrieved
THEN the name value should be returned in the response

GIVEN a request to create or update an API action with a name value
WHEN the name value is 255 characters or less
THEN the API action should be created or updated with the provided name

TC-300

🟢 lengdebegrensningen er på

Dekker:

GIVEN a request to create or update an API action with a name value
WHEN the name value exceeds 255 characters
THEN the request should be rejected with an appropriate validation error

TC-400

🟢 uten noe angitt "name" vil heller ikke returen inneholde noe name

Dekker:

GIVEN a request to create or update an API action without a name value
WHEN the API action is processed
THEN the API action should be created or updated with a null name value

[LeifHelstad]

OBS

🟡 Hvis "name" oppgis som en tom streng så aksepteres det at name er en tom steng og den forblir det. Men det er ikke noe krav mot dette så det passerer test.