Add validation to the Objects API prefill plugin to check if the user is the owner of the object #4398

stevenbal · 2024-06-17T13:39:54Z

The prefill plugin should check if the value of the auth attribute (this path will be configurable after #4396) is the same as the value of this authattribute for the authenticated user, if not, it should raise a PermissionDenied which should result in a 403 on the Submission create endpoint

We might want to remove the Submission in case this 403 happens, but I'm not 100% sure about this

We might also have to add a check to verify that the object is of the same objecttype as part of the config

The text was updated successfully, but these errors were encountered:

if an initial_data_reference is passed for the product prefill flow

…ass it with submissionCreate previously this was not passed properly, resulting in the initialDataReference not being sent on submissionCreate

if an initial_data_reference is passed for the product prefill flow

the initial data reference is passed from the SDK to the backend as part of the login URL. In order to pass it as part of the submission create body, it must be propagated from the authentication start/return views back to the SDK

if an initial_data_reference is passed for the product prefill flow

the initial data reference is passed from the SDK to the backend as part of the login URL. In order to pass it as part of the submission create body, it must be propagated from the authentication start/return views back to the SDK

if an initial_data_reference is passed for the product prefill flow

the initial data reference is passed from the SDK to the backend as part of the login URL. In order to pass it as part of the submission create body, it must be propagated from the authentication start/return views back to the SDK

… True this field is necessary to perform the initial data reference ownership check, which is performed when updating existing objects

when resetting values in the Objects API prefill form

* several cleanups of code * also raise errors in prefill scenario * explicitly raise error if auth attribute cannot be found at path * add contextmanager to use VCR in setUpTestData * remove REGISTRATION_OBJECTS_API_ENABLE_EXISTING_OBJECT_INTEGRATION feature flag (already added in 2.8.x) * add separate fieldset for updateExistingObject in registration fields * make authAttributePath disabled instead of not required if updateExistingObject is false * use PropTypes.node instead of PropTypes.string for Objects API fields helptexts/labels

* raise PermissionDenied instead of ImproperlyConfigured in verify_initial_data_ownership in case of bad configuration * let PermissionDenied errors bubble up during prefill, causing a 403 * show missing validation errors for other objects API prefill fields

The TargetPathSelect component is now decoupled from its possible FieldArray parent, and the option label display is incorporated in the component itself so that options no longer need to be pre-processed. On top of that, it's now refactored to be based on react-select for consistency in the UI, and separate stories have been added so we can do (visual) regression testing/isolated development. We use this component in a number of places now: * the path to the auth attribute (no variablesMapping parent context), used in registration and prefill plugins for the Objects API * the path for the generic Object Types V2 registration mapping, here a variablesMapping parent container/context is relevant and different form state management semantics apply * the path to specialized AddressNL subfield mappings - a parent is relevant, but not within a bigger variable mapping so we can use the standard field assignment semantics of Formik.

Instead of prop-drilling, make sure to process validation errors at the locations where the shape/structure is known and rely on the generic mechanisms to pass/display the validation errors. This also adds some JSDoc type hinting to the helpers because I keep getting lost on what the expected shape of data/input is.

* Ensure we use the deserialized, strongly typed options in plugins * Dropped unused error cases/flows that are obsoleted * Made serializer options all required, since the prefill cannot possibly work without and must match the type definitions of the options.

…n details The important pattern is that certain validation checks run, not the implementation details of the objects api prefill plugin. So, we can properly isolate this by setting up a different plugin registry and doing the dependency injection through a helper, applying the same pattern as with registration plugins.

Dropped the bits that are not relevant.

The task/generic machinery takes care of deserializing the plugin options and passes them to the hook for ownership verification, greatly simplifying the code that needs to be implemented.

Properly mock the registry of plugins instead of having to rely on particular demo plugins having certain behaviours or needing to mock implementation details in tests.

* Converted the tests to make use of VCR for the actual implementation details of the ownership verification * Simplified the tests and ensured they're unit tests focused around a single method. We have a generic pattern test that ensures the method gets called.

…refill-check-obj-permission ✨ [#4398] Check object ownership when creating submission

stevenbal mentioned this issue Jun 17, 2024

Als gemeente wil ik product-gegevens voor-invullen in een formulier #4266

Closed

8 tasks

stevenbal changed the title ~~Add validation to the submission create endpoint to check if the user is the owner of the object~~ Add validation to the Objects API prefill plugin to check if the user is the owner of the object Jun 17, 2024

stevenbal mentioned this issue Jun 17, 2024

Add query parameter to pass reference to existing object and send this to the backend on submissionCreate #4397

Closed

stevenbal added this to Development Jun 24, 2024

github-project-automation bot moved this to Todo in Development Jun 24, 2024

stevenbal added owner: den-haag enhancement labels Jun 24, 2024

stevenbal added this to the Release 2.8.0 milestone Jun 24, 2024

joeribekker assigned stevenbal and vaszig Aug 26, 2024

joeribekker modified the milestones: Release 2.8.0, Release 3.0 Sep 16, 2024

stevenbal unassigned vaszig Sep 23, 2024

stevenbal added a commit that referenced this issue Sep 23, 2024

🚧 [#4398] Check object ownership when creating submission

cdb11c0

if an initial_data_reference is passed for the product prefill flow

stevenbal mentioned this issue Sep 23, 2024

✨ [#4398] Check object ownership when creating submission #4696

Merged

9 tasks

stevenbal added a commit that referenced this issue Oct 1, 2024

🚧 [#4398] Check object ownership when creating submission

879270d

if an initial_data_reference is passed for the product prefill flow

stevenbal added a commit that referenced this issue Oct 1, 2024

✅ [#4398] Tests for submission start with initial data reference

8e700b5

stevenbal added a commit that referenced this issue Oct 1, 2024

✨ [#4398] Check object ownership when creating submission

0e2e5ca

if an initial_data_reference is passed for the product prefill flow

stevenbal added a commit that referenced this issue Oct 1, 2024

✅ [#4398] Tests for submission start with initial data reference

7891ead

stevenbal added a commit that referenced this issue Oct 1, 2024

✅ [#4398] Tests for submission start with initial data reference

18dc4e6

stevenbal added a commit that referenced this issue Oct 8, 2024

✨ [#4398] Check object ownership when creating submission

1e60355

if an initial_data_reference is passed for the product prefill flow

stevenbal added a commit that referenced this issue Oct 8, 2024

✅ [#4398] Tests for submission start with initial data reference

ac6305a

stevenbal added a commit that referenced this issue Oct 10, 2024

✨ [#4398] Check object ownership when creating submission

313af41

if an initial_data_reference is passed for the product prefill flow

stevenbal added a commit that referenced this issue Oct 10, 2024

✅ [#4398] Tests for submission start with initial data reference

ec8b3f1

stevenbal added a commit that referenced this issue Oct 10, 2024

✨ [#4398] Check object ownership when creating submission

823b2cf

if an initial_data_reference is passed for the product prefill flow

stevenbal added a commit that referenced this issue Oct 10, 2024

✅ [#4398] Tests for submission start with initial data reference

a32d271

sergei-maertens pushed a commit that referenced this issue Dec 2, 2024

✨ [#4398] Make auth_attribute_path required if update existing object…

116fa15

… True this field is necessary to perform the initial data reference ownership check, which is performed when updating existing objects

sergei-maertens pushed a commit that referenced this issue Dec 2, 2024

✨ [#4398] Add authAttributePath to objects prefill form

3e1f834

sergei-maertens pushed a commit that referenced this issue Dec 2, 2024

🌐 [#4398] Compile JS translations

3616e79

sergei-maertens pushed a commit that referenced this issue Dec 2, 2024

✨ [#4398] Display errors for authAttributePath in modal

94a16e7

sergei-maertens pushed a commit that referenced this issue Dec 2, 2024

♻️ [#4398] Use setValues instead of repeating setFieldValue

055d89b

when resetting values in the Objects API prefill form

sergei-maertens pushed a commit that referenced this issue Dec 2, 2024

♻️ [#4398] Use TargetPathSelect for auth attribute path

04cee61

sergei-maertens pushed a commit that referenced this issue Dec 2, 2024

✅ [#4398] Re-record VCR cassettes for Objects API prefill

22b6430

sergei-maertens pushed a commit that referenced this issue Dec 2, 2024

✅ [#4398] Fix coverage for Objects API ownership validation

1cd37e4

sergei-maertens added a commit that referenced this issue Dec 2, 2024

🌐 [#4398] Update extracted translations (JS)

addb139

sergei-maertens added a commit that referenced this issue Dec 3, 2024

🚸 [#4398] Disable copy button until a backend is selected

c77276c

sergei-maertens added a commit that referenced this issue Dec 4, 2024

🎨 [#4398] Clean up test code

e6fe66f

Dropped the bits that are not relevant.

sergei-maertens added a commit that referenced this issue Dec 4, 2024

🏷️ [#4398] Fix type errors in Objects API tests

20cb7d0

sergei-maertens closed this as completed in #4696 Dec 4, 2024

sergei-maertens added a commit that referenced this issue Dec 4, 2024

Merge pull request #4696 from open-formulieren/feature/4398-product-p…

f678921

…refill-check-obj-permission ✨ [#4398] Check object ownership when creating submission

github-project-automation bot moved this from Implemented to Done in Development Dec 4, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add validation to the Objects API prefill plugin to check if the user is the owner of the object #4398

Add validation to the Objects API prefill plugin to check if the user is the owner of the object #4398

stevenbal commented Jun 17, 2024 •

edited

Loading

Add validation to the Objects API prefill plugin to check if the user is the owner of the object #4398

Add validation to the Objects API prefill plugin to check if the user is the owner of the object #4398

Comments

stevenbal commented Jun 17, 2024 • edited Loading

stevenbal commented Jun 17, 2024 •

edited

Loading