Altinn / altinn-notifications

Altinn platform microservice for handling notifications (mail, sms, etc)
MIT License
2 stars 3 forks source link

Verification of `resourceId` before doing Profile look up and Authorisation request #542

Open khanrn opened 1 month ago

khanrn commented 1 month ago

Description

While working on #510 it is discovered that there is (probably) no mechanism for verifying the existence of resourceId input before doing Profile look up and Authorisation request. It would be better to have such verification mechanism.

Reference: https://github.com/Altinn/altinn-notifications/blob/5336e501c1409d7f4a505eadaba703f4532d3488/src/Altinn.Notifications.Core/Services/ContactPointService.cs#L169

Probable Solution

  1. First we need to verify from Storage that the app exists with the resource ID.
  2. Then we need to verify the resource ID with a call to resource registry. Altinn Access Management has implemented a ResourceRegistryClient, which can be a source of inspiration to implement a client here in a similar fashion.

Additional Information

Related Issue(s) & PR(s):

  1. 510

  2. 540