Skip to content

Commit 7589e07

Browse files
authored
Merge pull request #258 from eclipse-tractusx/release/v1.8.0-RC5
build(1.8.0-RC5): merge release into main
2 parents 4bc2a36 + 4d890c8 commit 7589e07

File tree

18 files changed

+201
-51
lines changed

18 files changed

+201
-51
lines changed

CHANGELOG.md

+11
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,17 @@
22

33
New features, fixed bugs, known defects and other noteworthy changes to each release of the Catena-X Portal Assets.
44

5+
## 1.8.0-RC5
6+
7+
### Change
8+
9+
- improved offer release process documentation
10+
- updated security assessment
11+
12+
### Bugfix
13+
14+
- fixed links (relative links, image links and links to GitHub) in documentation app
15+
516
## 1.8.0-RC4
617

718
### Change

docs/developer/01. Registration/04. Registration Approval/03. Registration Approval Process.md

+2-3
Original file line numberDiff line numberDiff line change
@@ -551,9 +551,8 @@ Response "Success" => set status to "DONE"
551551
##### Details "Activation"
552552

553553
<p align="center">
554-
<img width="687" alt="image" src="https://raw.githubusercontent.com/eclipse-tractusx/portal-assets/main/docs/static/identity-wallet-overview.png
555-
">
556-
</p>p>
554+
<img width="687" alt="image" src="https://raw.githubusercontent.com/eclipse-tractusx/portal-assets/main/docs/static/identity-wallet-overview.png">
555+
</p>
557556

558557
<br>
559558
The complete company account activation (as a result of the successful application checklist finalization) is automatically executed when the following pre-requisites are fulfilled:

docs/developer/02. Technical Integration/02. Identity Provider Management/02. Configure Company IdP.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ The initial overlay is used to create the IdP record with the respective IdP typ
1111
<br>
1212

1313
<p align="center">
14-
<img width="680" alt="image" src="https://raw.githubusercontent.com/eclipse-tractusx/portal-assets/main/docs/static/create-idp-start.png>
14+
<img width="680" alt="image" src="https://raw.githubusercontent.com/eclipse-tractusx/portal-assets/main/docs/static/create-idp-start.png">
1515
</p>
1616

1717
<br>

docs/developer/03. User Management/04. App Access Management/02. Assign App Role Page Overview.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,7 @@ Example:
8484

8585
In case the api is responding with an empty array, the UI will display following messages:
8686

87-
<img width="700" alt="image" src="https://raw.githubusercontent.com/eclipse-tractusx/portal-assets/main/docs/static/add-permissions-company-user.png">
87+
<img width="700" alt="image" src="https://raw.githubusercontent.com/eclipse-tractusx/portal-assets/main/docs/static/app-user-list.png">
8888

8989
<br>
9090
<br>

docs/developer/04. Apps/02. App Release Process/App Release Process.md

+74-9
Original file line numberDiff line numberDiff line change
@@ -417,15 +417,36 @@ In case the privacy policies can not get loaded, the response will look like def
417417
<br>
418418
<br>
419419

420-
#### Step 3 - Terms & Conditions / Consent
420+
### Step 3 - Terms & Conditions / Consent
421+
422+
<br>
423+
424+
This step in the app release process is ensuring that your application meets the marketplace's standards and complies with all legal and regulatory requirements.
425+
Following actions are covered in the step:
426+
427+
- Agreement to Marketplace Rules and Terms & Conditions
428+
- Upload of App Dataspace Conformity Certification
429+
430+
<br>
421431

422432
<img width="576" alt="image" src="https://raw.githubusercontent.com/eclipse-tractusx/portal-assets/main/docs/static/app-creation-consent-contract-input.png">
423433

424-
Depending on the response of the endpoint #1 GET agreements, the user will be enabled to download related documents from the portal to read through the relevant agreement details. Expected formats are pdf, however other formats can get supported as well.
434+
<br>
435+
<br>
436+
437+
### Agreement to Marketplace Rules and Terms & Conditions
438+
439+
Before the app provider can proceed with the release process, they first must agree to the marketplace's rules and Terms & Conditions. This agreement is essential for ensuring that the provider app adheres to the marketplace's quality standards, operational guidelines, and legal requirements.
440+
To display the relevant agreements, respective linked documents and to store the provider consent, the following endpoints are to be used:
441+
442+
- GET /api/apps/appreleaseprocess/agreementData - used to fetch all necessary appReleaseProcess agreements
443+
- GET /api/administration/documents/frameDocuments/{documentId} - used to enable the user to access agreement documents
444+
- POST /api/apps/appreleaseprocess/consent/{appId}/agreementConsents - post consent
445+
- GET /api/apps/AppReleaseProcess/{appId}/appStatus - to check the current given consent status
425446

426447
<br>
427448

428-
###### #1 Retrieve Terms & Conditions
449+
#### #1 Retrieve Terms & Conditions
429450

430451
Terms and Conditions are fetched via the endpoint
431452

@@ -439,9 +460,9 @@ Response Body
439460

440461
[
441462
{
442-
"agreementId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
463+
"agreementId": "uuid",
443464
"name": "string",
444-
"documentId": "3fa85f64-5717-4562-b3fc-2c963f66afa6"
465+
"documentId": "uuid"
445466
}
446467
]
447468

@@ -462,7 +483,7 @@ If the documentId is NULL, the agreement is displayed without link (as currently
462483
<br>
463484
<br>
464485

465-
###### #2 Retrieve Documents
486+
#### #2 Retrieve Documents
466487

467488
Terms and Conditions with an document ID in API endpoint #1 can get retrieved via the document endpoint GET /frameDocuments/{documentId}
468489

@@ -479,7 +500,48 @@ Response Body
479500
<br>
480501
<br>
481502

482-
###### #3 Upload Document
503+
<br>
504+
<br>
505+
506+
#### #3 Store Consent for Agreements
507+
508+
The given consent or the unapproved consent for the needed agreements are stored via the POST endpoint.
509+
The endpoint will store the newly added agreement status as well as update existing consent status if necessary.
510+
511+
```diff
512+
! POST: /api/apps/appreleaseprocess/consent/{appId}/agreementConsents
513+
```
514+
515+
<br>
516+
517+
Response Body
518+
519+
{
520+
"agreements": [
521+
{
522+
"agreementId": "uuid",
523+
"consentStatus": "ACTIVE"
524+
}
525+
]
526+
}
527+
528+
<br>
529+
<br>
530+
531+
### Conformity Certification
532+
533+
The Service Dataspace Conformity Certification is a document that certifies that the service provider service complies with specific data handling, privacy, and security standards. This certification is crucial for marketplaces that prioritize the safety and privacy of their users.
534+
To support the conformity certificate upload, following endpoints are available:
535+
536+
- GET /api/apps/appeReleaseProcess/{appId}/appStatus - to retrieve already uploaded certificates (if any existing)
537+
- PUT /api/apps/appreleaseprocess/updateappdoc/{appId}/documentType/{documentTypeId}/documents - to store the conformity certificate
538+
- DELETE /api/apps/appreleaseprocess/documents/{documentId} - used to delete the conformity certificate
539+
540+
Note, only PDF is supported.
541+
542+
<br>
543+
544+
#### #1 Upload Document
483545

484546
The user has to upload the app conformity document.
485547

@@ -491,18 +553,21 @@ Type: CONFORMITY_APPROVAL_BUSINESS_APPS
491553

492554
<br>
493555

494-
###### #4 DELETE Document
556+
#### #2 DELETE Document
495557

496558
In case the user identifiers that a wrong document got uploaded in the respective step, the DELETE endpoint is used to delete documents linked to the app.
497559
Important: the deletion is not reversible - since the app is still under DRAFT, all app related details will get deleted immediately.
498560

499561
```diff
500-
! Delete: /api/apps/appreleaseprocess/documents/{documentId}
562+
! DELETE /api/apps/appreleaseprocess/documents/{documentId}
501563
```
502564

503565
<br>
504566
<br>
505567

568+
<br>
569+
<br>
570+
506571
#### Step 4 - Integration - Role Upload
507572

508573
<br>

docs/developer/05. Service(s)/02. Service Release Process/03.Terms&Conditions.md

+33-4
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,28 @@
22

33
<br>
44

5-
<img width="536" alt="image" src="https://raw.githubusercontent.com/eclipse-tractusx/portal-assets/main/docs/static/service-creation-contract-constent.png">
5+
This step in the service release process is ensuring that your application meets the marketplace's standards and complies with all legal and regulatory requirements.
6+
Following actions are covered in the step:
67

7-
Depending on the response of the endpoint #1 GET agreements, the user will be enabled to download related documents from the portal to read through the relevant agreement details. Expected formats are pdf, however other formats can get supported as well.
8+
- Agreement to Marketplace Rules and Terms & Conditions
9+
- Upload of App Dataspace Conformity Certification
810

911
<br>
1012

11-
### Implementation Details
13+
<img width="536" alt="image" src="https://raw.githubusercontent.com/eclipse-tractusx/portal-assets/main/docs/static/service-creation-contract-constent.png">
14+
15+
<br>
16+
<br>
17+
18+
### Agreement to Marketplace Rules and Terms & Conditions
19+
20+
Before the service provider can proceed with the release process, they first must agree to the marketplace's rules and Terms & Conditions. This agreement is essential for ensuring that the service provider service adheres to the marketplace's quality standards, operational guidelines, and legal requirements.
21+
To display the relevant agreements, respective linked documents and to store the provider consent, the following endpoints are to be used:
22+
23+
- GET /api/services/servicerelease/agreementData - used to fetch all necessary serviceReleaseProcess agreements
24+
- GET /api/administration/documents/frameDocuments/{documentId} - used to enable the user to access agreement documents
25+
- POST /api/services/servicerelease/consent/{serviceId}/agreementConsents - post consent
26+
- GET /api/services/ServiceRelease/{serviceId}/serviceStatus - to check the current given consent status
1227

1328
#### #1 Retrieve Terms & Conditions
1429

@@ -49,7 +64,7 @@ If the documentId is NULL, the agreement is displayed without link (as currently
4964

5065
#### #2 Retrieve Documents
5166

52-
Terms and Conditions with an document ID in API endpoint #1 can get retrieved via the document endpoint GET /frameDocuments/{documentId}
67+
Depending on the response of the endpoint #1 GET agreements, the user will be enabled to download related documents from the portal to read through the relevant agreement details. Expected formats are pdf, however other formats can get supported as well.
5368

5469
```diff
5570
Get: /api/administration/documents/frameDocuments/{documentId}
@@ -89,6 +104,20 @@ Response Body
89104
<br>
90105
<br>
91106

107+
### Conformity Certification
108+
109+
The Service Dataspace Conformity Certification is a document that certifies that the service provider service complies with specific data handling, privacy, and security standards. This certification is crucial for marketplaces that prioritize the safety and privacy of their users.
110+
To support the conformity certificate upload, following endpoints are available:
111+
112+
- GET /api/services/ServiceRelease/{serviceId}/serviceStatus - to retrieve already uploaded certificates (if any existing)
113+
- PUT /api/services/ServiceRelease/updateservicedoc/{serviceId}/documentType/{documentTypeId}/documents - to store the conformity certificate
114+
- DELETE /api/services/ServiceRelease/documents/{documentId} - used to delete the conformity certificate
115+
116+
Note, only PDF is supported.
117+
118+
<br>
119+
<br>
120+
92121
## NOTICE
93122

94123
This work is licensed under the [Apache-2.0](https://www.apache.org/licenses/LICENSE-2.0).

docs/developer/Technical Documentation/Architecture/Security-Assessment.md

+4-3
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,8 @@
55
| Contact for product | [@evegufy](https://github.com/evegufy) <br> [@jjeroch](https://github.com/jjeroch) |
66
| Security responsible | [@SSIRKC](https://github.com/SSIRKC) <br> [Szymon Kowalczyk]([email protected]) |
77
| Version number of product | 23.12 |
8-
| Dates of assessment | 2023-11-14: Re-Assessment |
9-
| Status of assessment | RE-ASSESSMENT DRAFT |
8+
| Dates of assessment | 2024-02-13: Re-Assessment |
9+
| Status of assessment | RE-ASSESSMENT Finalized |
1010

1111
## Product Description
1212

@@ -133,7 +133,7 @@ RS <-->|Company data \n user role data \n T&C / consent agreements| RF
133133
MSS <--> PF
134134
MSS <-.-> K
135135
MSS ==>|Company app subscription data \n app service data + user preferences| PDB
136-
SDF <--> CH
136+
SDF <-->|Out of Scope \n details may be found in Gaia-X \n and SD Factory Repositories| CH
137137
SDT -.->|Product meta data| PF
138138
NC1 & CU-Shared1 & NC2 & CU-Shared2 & NC3 & CU-Shared3 & CU-Own -.-> |OIDC| K
139139
K <-.-> |"Authentication/authorization data (using JWT)"| RF & PF
@@ -208,6 +208,7 @@ All threats identified are mitigated.
208208
- Software Composition Analysis (SCA) - VeraCode
209209
- Container Scan conducted - Trivy
210210
- Infrastructure as Code - KICS
211+
- Securing code, dependencies, containers, IaC and Cloud Deployments - SNYK
211212

212213
Also see [Penetrations Tests](../Tests/Tests.md#penetration-tests).
213214

Loading

docs/user/02. Technical Integration/02. Identity Provider Management/index.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
- [User Migration](./03.%20User%20Migration.md)
77
- [Identity Provider Disablement](./05.%20Disable%20Identity%20Provider.md)
88
- [Identity Provider Deletion](./04.%20Identity%20Provider%20Deletion.md)
9-
- [FAQ](./04.%20FAQ.md)
9+
- [FAQ](./06.%20FAQ.md)
1010

1111
<br>
1212
<br>

docs/user/04. App(s)/02. App Release Process/03. Terms&Conditions.md

+26-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
### Step 3 - Terms & Conditions / Consent
22

3-
Under Step 3 - the user needs to agree to the terms and conditions of the app publish rules before getting on the marketplace. This section is mandatory and displays agreement documents; if any documents are linked to the relevant agreement types
3+
This step in the app release process is ensuring that your application meets the marketplace's standards and complies with all legal and regulatory requirements. Below is a detailed guide on how to complete this phase successfully.
44

55
<br>
66

@@ -11,6 +11,31 @@ Under Step 3 - the user needs to agree to the terms and conditions of the app pu
1111
<br>
1212
<br>
1313

14+
#### Agreement to Marketplace Rules and Terms & Conditions
15+
16+
Before you can proceed with uploading your app to the marketplace, you must first agree to the marketplace's rules and Terms & Conditions. This agreement is essential for ensuring that your app adheres to the marketplace's quality standards, operational guidelines, and legal requirements. To complete this step, follow the instructions below:
17+
18+
- **Review the Documents:** Carefully read through the marketplace rules and Terms & Conditions. Pay special attention to sections detailing your rights and responsibilities as a developer/provider, as well as any requirements your app must meet to be eligible for listing.
19+
20+
- **Accept the Agreement:** After reviewing the documents, you will find an option to accept the Terms & Conditions. This usually involves checking a box to indicate your agreement and then clicking a button to confirm. By doing so, you are legally binding yourself to these terms, so ensure you understand them fully before agreeing.
21+
22+
#### Upload of App Dataspace Conformity Certification
23+
24+
The App Dataspace Conformity Certification is a document that certifies your app complies with specific catena-x dataspace, data handling, privacy, and security standards. This certification is crucial for marketplaces that prioritize the safety and privacy of their users as well as it gives the customer the trust that all catena-x dataspace quality standards are followed. Follow these steps to upload your certification:
25+
26+
- **Prepare Your Certification:** Before you can upload your certification, you must obtain it from a recognized certifying authority. Ensure that your app meets all the criteria for certification and that your documentation is up to date. Respective certification authorities can get found on the catena-x homepage.
27+
28+
- **Access the Certification Upload Section:** On the app submission page, look for the section designated for uploading conformity certifications. This section is typically found after the agreement to marketplace rules and Terms & Conditions.
29+
30+
- **Upload Your Certification:** Click on the upload button and select your certification document from your files. The marketplace accepts PDF format. Ensure the document is clear and all information is legible.
31+
32+
<br>
33+
34+
Once you have successfully completed the page; proceed to the next step "Technical Integration".
35+
36+
<br>
37+
<br>
38+
1439
## NOTICE
1540

1641
This work is licensed under the [Apache-2.0](https://www.apache.org/licenses/LICENSE-2.0).

docs/user/05. Service(s)/02. Service Release Process/03. Terms&Conditions.md

+23-2
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,37 @@
11
### Step 3 - Terms & Conditions / Consent
22

3-
Under Step 3 - the user needs to agree to the terms and conditions of the service publish rules before getting on the marketplace. This section is mandatory and displays agreement documents; if any documents are linked to the relevant agreement types
3+
This step in the service release process is ensuring that your service offer meets the marketplace's standards and complies with all legal and regulatory requirements. Below is a detailed guide on how to complete this phase successfully.
44

55
<br>
66

77
<p align="center">
88
<img width="536" alt="image" src="https://raw.githubusercontent.com/eclipse-tractusx/portal-assets/main/docs/static/service-creation-contract-constent.png">
99
</p>
1010

11+
<br>
12+
<br>
13+
14+
#### Agreement to Marketplace Rules and Terms & Conditions
15+
16+
Before you can proceed with uploading your service offer to the marketplace, you must first agree to the marketplace's rules and Terms & Conditions. This agreement is essential for ensuring that your service adheres to the marketplace's quality standards, operational guidelines, and legal requirements. To complete this step, follow the instructions below:
17+
18+
- **Review the Documents:** Carefully read through the marketplace rules and Terms & Conditions. Pay special attention to sections detailing your rights and responsibilities as a developer/provider, as well as any requirements your service must meet to be eligible for listing.
19+
20+
- **Accept the Agreement:** After reviewing the documents, you will find an option to accept the Terms & Conditions. This usually involves checking a box to indicate your agreement and then clicking a button to confirm. By doing so, you are legally binding yourself to these terms, so ensure you understand them fully before agreeing.
21+
22+
#### Upload of Service Dataspace Conformity Certification
23+
24+
The Service Dataspace Conformity Certification is a document that certifies your service complies with specific catena-x dataspace, data handling, privacy, and security standards. This certification is crucial for marketplaces that prioritize the safety and privacy of their users as well as it gives the customer the trust that all catena-x dataspace quality standards are followed. Follow these steps to upload your certification:
25+
26+
- **Prepare Your Certification:** Before you can upload your certification, you must obtain it from a recognized certifying authority. Ensure that your service meets all the criteria for certification and that your documentation is up to date. Respective certification authorities can get found on the catena-x homepage or within the portal company role details "Service Provider".
27+
28+
- **Access the Certification Upload Section:** On the service submission page, look for the section designated for uploading conformity certifications. This section is typically found after the agreement to marketplace rules and Terms & Conditions.
29+
30+
- **Upload Your Certification:** Click on the upload button and select your certification document from your files. The marketplace accepts PDF format. Ensure the document is clear and all information is legible.
31+
1132
<br>
1233

13-
In case any documents or further details to the agreements are available, the agreement will be blue highlighted and can get downloaded by clicking on the agreement title.
34+
Once you have successfully completed the page; proceed to the next step "Technical Integration" or you might directly get forwarded to the "Verify&Submit" step, depending on your service offering type.
1435

1536
<br>
1637
<br>

0 commit comments

Comments
 (0)