feat(auth-admin): Delegation admin module

apps/portals/admin/src/auth.ts

@@ -38,6 +38,8 @@ if (userMocked) {
       AdminPortalScope.signatureCollectionProcess,
       AdminPortalScope.formSystem,
       AdminPortalScope.formSystemSuperUser,
+      AdminPortalScope.delegationSystem,
+      AdminPortalScope.delegationSystemAdmin,
     ],
     post_logout_redirect_uri: `${window.location.origin}`,
     userStorePrefix: 'ap.',

apps/portals/admin/src/lib/masterNavigation.ts

@@ -14,6 +14,7 @@ import { signatureCollectionNavigation } from '@island.is/portals/admin/signatur
 import { serviceDeskNavigation } from '@island.is/portals/admin/service-desk'
 import { petitionNavigation } from '@island.is/portals/admin/petition'
 import { formSystemNavigation } from '@island.is/form-system'
+import { delegationAdminNav } from 'delegation-admin'
 
 export const rootNavigationItem: PortalNavigationItem = {
   name: coreMessages.overview,
@@ -44,7 +45,10 @@ export const TOP_NAVIGATION: PortalNavigationItem = {
     serviceDeskNavigation,
     // Meðmælasöfnun
     signatureCollectionNavigation,
+    // Formakerfi
     formSystemNavigation,
+    // Aðgangsstýring umboð
+    delegationAdminNav,
   ],
 }
 export const BOTTOM_NAVIGATION: PortalNavigationItem = {

apps/portals/admin/src/lib/modules.ts

@@ -10,6 +10,7 @@ import { petitionModule } from '@island.is/portals/admin/petition'
 import { serviceDeskModule } from '@island.is/portals/admin/service-desk'
 import { signatureCollectionModule } from '@island.is/portals/admin/signature-collection'
 import { formSystemModule } from '@island.is/form-system'
+import { delegationAdminModule } from 'delegation-admin'
 
 /**
  * NOTE:
@@ -30,4 +31,5 @@ export const modules: PortalModule[] = [
   serviceDeskModule,
   signatureCollectionModule,
   formSystemModule,
+  delegationAdminModule,
 ]

apps/services/auth/admin-api/infra/auth-admin-api.ts

@@ -1,4 +1,21 @@
-import { json, service, ServiceBuilder } from '../../../../../infra/src/dsl/dsl'
+import {
+  json,
+  ref,
+  service,
+  ServiceBuilder,
+} from '../../../../../infra/src/dsl/dsl'
+
+const REDIS_NODE_CONFIG = {
+  dev: json([
+    'clustercfg.general-redis-cluster-group.5fzau3.euw1.cache.amazonaws.com:6379',
+  ]),
+  staging: json([
+    'clustercfg.general-redis-cluster-group.ab9ckb.euw1.cache.amazonaws.com:6379',
+  ]),
+  prod: json([
+    'clustercfg.general-redis-cluster-group.dnugi2.euw1.cache.amazonaws.com:6379',
+  ]),
+}
 
 export const serviceSetup = (): ServiceBuilder<'services-auth-admin-api'> => {
   return service('services-auth-admin-api')
@@ -25,10 +42,29 @@ export const serviceSetup = (): ServiceBuilder<'services-auth-admin-api'> => {
         ]),
         prod: json(['https://innskra.island.is']),
       },
+      XROAD_NATIONAL_REGISTRY_ACTOR_TOKEN: 'true',
+      XROAD_RSK_PROCURING_ACTOR_TOKEN: 'true',
+      XROAD_NATIONAL_REGISTRY_SERVICE_PATH: {
+        dev: 'IS-DEV/GOV/10001/SKRA-Protected/Einstaklingar-v1',
+        staging: 'IS-TEST/GOV/6503760649/SKRA-Protected/Einstaklingar-v1',
+        prod: 'IS/GOV/6503760649/SKRA-Protected/Einstaklingar-v1',
+      },
+      XROAD_NATIONAL_REGISTRY_REDIS_NODES: REDIS_NODE_CONFIG,
+      XROAD_RSK_PROCURING_REDIS_NODES: REDIS_NODE_CONFIG,
+      COMPANY_REGISTRY_XROAD_PROVIDER_ID: {
+        dev: 'IS-DEV/GOV/10006/Skatturinn/ft-v1',
+        staging: 'IS-TEST/GOV/5402696029/Skatturinn/ft-v1',
+        prod: 'IS/GOV/5402696029/Skatturinn/ft-v1',
+      },
+      COMPANY_REGISTRY_REDIS_NODES: REDIS_NODE_CONFIG,
     })
     .secrets({
       CLIENT_SECRET_ENCRYPTION_KEY:
         '/k8s/services-auth/admin-api/CLIENT_SECRET_ENCRYPTION_KEY',
+      IDENTITY_SERVER_CLIENT_SECRET:
+        '/k8s/services-auth/IDENTITY_SERVER_CLIENT_SECRET',
+      NATIONAL_REGISTRY_IDS_CLIENT_SECRET:
+        '/k8s/xroad/client/NATIONAL-REGISTRY/IDENTITYSERVER_SECRET',
     })
     .ingress({
       primary: {

apps/services/auth/admin-api/src/app/app.module.ts

@@ -3,6 +3,7 @@ import { ConfigModule } from '@nestjs/config'
 import { SequelizeModule } from '@nestjs/sequelize'
 
 import {
+  DelegationApiUserSystemNotificationConfig,
   DelegationConfig,
   SequelizeConfigService,
 } from '@island.is/auth-api-lib'
@@ -24,6 +25,12 @@ import { ClientSecretsModule } from './v2/secrets/client-secrets.module'
 import { TenantsModule } from './v2/tenants/tenants.module'
 import { ScopesModule } from './v2/scopes/scopes.module'
 import { ProvidersModule } from './v2/providers/providers.module'
+import { DelegationAdminModule } from './v2/delegations/delegation-admin.module'
+import { RskRelationshipsClientConfig } from '@island.is/clients-rsk-relationships'
+import { FeatureFlagConfig } from '@island.is/nest/feature-flags'
+import { IdsClientConfig, XRoadConfig } from '@island.is/nest/config'
+import { NationalRegistryClientConfig } from '@island.is/clients/national-registry-v2'
+import { CompanyRegistryConfig } from '@island.is/clients/rsk/company-registry'
 
 @Module({
   imports: [
@@ -46,9 +53,18 @@ import { ProvidersModule } from './v2/providers/providers.module'
     ProblemModule,
     ProvidersModule,
     ScopesModule,
+    DelegationAdminModule,
     ConfigModule.forRoot({
       isGlobal: true,
-      load: [DelegationConfig],
+      load: [
+        DelegationConfig,
+        RskRelationshipsClientConfig,
+        NationalRegistryClientConfig,
+        CompanyRegistryConfig,
+        FeatureFlagConfig,
+        XRoadConfig,
+        IdsClientConfig,
+      ],
       envFilePath: ['.env', '.env.secret'],
     }),
   ],

apps/services/auth/admin-api/src/app/v2/delegations/delegation-admin.controller.ts

@@ -0,0 +1,98 @@
+import {
+  Controller,
+  Delete,
+  Get,
+  Headers,
+  Param,
+  UseGuards,
+} from '@nestjs/common'
+import { ApiTags } from '@nestjs/swagger'
+
+import {
+  CurrentUser,
+  IdsUserGuard,
+  Scopes,
+  ScopesGuard,
+  User,
+} from '@island.is/auth-nest-tools'
+import {
+  DelegationAdminCustomDto,
+  DelegationAdminCustomService,
+} from '@island.is/auth-api-lib'
+import { Documentation } from '@island.is/nest/swagger'
+import { Audit, AuditService } from '@island.is/nest/audit'
+import { DelegationAdminScopes } from '@island.is/auth/scopes'
+import flatMap from 'lodash/flatMap'
+import { isDefined } from '@island.is/shared/utils'
+
+const namespace = '@island.is/auth/delegation-admin'
+
+@UseGuards(IdsUserGuard, ScopesGuard)
+@Scopes(DelegationAdminScopes.read)
+@ApiTags('delegation-admin')
+@Controller('delegation-admin')
+@Audit({ namespace })
+export class DelegationAdminController {
+  constructor(
+    private readonly delegationAdminService: DelegationAdminCustomService,
+    private readonly auditService: AuditService,
+  ) {}
+
+  @Get()
+  @Documentation({
+    response: { status: 200, type: DelegationAdminCustomDto },
+    request: {
+      header: {
+        'X-Query-National-Id': {
+          required: true,
+          description: 'fetch delegations for this national id',
+        },
+      },
+    },
+  })
+  @Audit<DelegationAdminCustomDto>({
+    resources: (delegation) =>
+      flatMap([
+        ...delegation.incoming.map((d) => d.id ?? undefined),
+        ...delegation.outgoing.map((d) => d.id ?? undefined),
+      ]).filter(isDefined),
+  })
+  async getDelegationAdmin(
+    @Headers('X-Query-National-Id') nationalId: string,
+  ): Promise<DelegationAdminCustomDto> {
+    return await this.delegationAdminService.getAllDelegationsByNationalId(
+      nationalId,
+    )
+  }
+
+  @Delete(':delegationId')
+  @Scopes(DelegationAdminScopes.admin)
+  @Documentation({
+    response: { status: 204 },
+    request: {
+      params: {
+        delegationId: {
+          required: true,
+          description: 'The id of the delegation to delete',
+        },
+      },
+    },
+  })
+  delete(
+    @CurrentUser() user: User,
+    @Param('delegationId') delegationId: string,
+  ) {
+    return this.auditService.auditPromise(
+      {
+        auth: user,
+        namespace,
+        action: 'delete',
+        resources: delegationId,
+        meta: (deleted) => ({
+          deleted,
+        }),
+      },
+      this.delegationAdminService.deleteDelegation(user, delegationId),
+    )
+  }
+}

apps/services/auth/admin-api/src/app/v2/delegations/delegation-admin.module.ts

@@ -0,0 +1,12 @@
+import { Module } from '@nestjs/common'
+
+import { DelegationsModule as AuthDelegationsModule } from '@island.is/auth-api-lib'
+import { FeatureFlagModule } from '@island.is/nest/feature-flags'
+import { DelegationAdminController } from './delegation-admin.controller'
+
+@Module({
+  imports: [AuthDelegationsModule, FeatureFlagModule],
+  controllers: [DelegationAdminController],
+  providers: [],
+})
+export class DelegationAdminModule {}

charts/identity-server/values.dev.yaml

@@ -213,6 +213,8 @@ namespaces:
 services-auth-admin-api:
   enabled: true
   env:
+    COMPANY_REGISTRY_REDIS_NODES: '["clustercfg.general-redis-cluster-group.5fzau3.euw1.cache.amazonaws.com:6379"]'
+    COMPANY_REGISTRY_XROAD_PROVIDER_ID: 'IS-DEV/GOV/10006/Skatturinn/ft-v1'
     DB_HOST: 'postgres-applications.internal'
     DB_NAME: 'servicesauth'
     DB_REPLICAS_HOST: 'postgres-applications-reader.internal'
@@ -222,6 +224,11 @@ services-auth-admin-api:
     LOG_LEVEL: 'info'
     NODE_OPTIONS: '--max-old-space-size=691 -r dd-trace/init'
     SERVERSIDE_FEATURES_ON: ''
+    XROAD_NATIONAL_REGISTRY_ACTOR_TOKEN: 'true'
+    XROAD_NATIONAL_REGISTRY_REDIS_NODES: '["clustercfg.general-redis-cluster-group.5fzau3.euw1.cache.amazonaws.com:6379"]'
+    XROAD_NATIONAL_REGISTRY_SERVICE_PATH: 'IS-DEV/GOV/10001/SKRA-Protected/Einstaklingar-v1'
+    XROAD_RSK_PROCURING_ACTOR_TOKEN: 'true'
+    XROAD_RSK_PROCURING_REDIS_NODES: '["clustercfg.general-redis-cluster-group.5fzau3.euw1.cache.amazonaws.com:6379"]'
   grantNamespaces:
     - 'nginx-ingress-external'
     - 'nginx-ingress-internal'
@@ -275,6 +282,8 @@ services-auth-admin-api:
     CLIENT_SECRET_ENCRYPTION_KEY: '/k8s/services-auth/admin-api/CLIENT_SECRET_ENCRYPTION_KEY'
     CONFIGCAT_SDK_KEY: '/k8s/configcat/CONFIGCAT_SDK_KEY'
     DB_PASS: '/k8s/servicesauth/DB_PASSWORD'
+    IDENTITY_SERVER_CLIENT_SECRET: '/k8s/services-auth/IDENTITY_SERVER_CLIENT_SECRET'
+    NATIONAL_REGISTRY_IDS_CLIENT_SECRET: '/k8s/xroad/client/NATIONAL-REGISTRY/IDENTITYSERVER_SECRET'
   securityContext:
     allowPrivilegeEscalation: false
     privileged: false

charts/identity-server/values.prod.yaml

@@ -210,6 +210,8 @@ namespaces:
 services-auth-admin-api:
   enabled: true
   env:
+    COMPANY_REGISTRY_REDIS_NODES: '["clustercfg.general-redis-cluster-group.dnugi2.euw1.cache.amazonaws.com:6379"]'
+    COMPANY_REGISTRY_XROAD_PROVIDER_ID: 'IS/GOV/5402696029/Skatturinn/ft-v1'
     DB_HOST: 'postgres-ids.internal'
     DB_NAME: 'servicesauth'
     DB_REPLICAS_HOST: 'postgres-ids.internal'
@@ -219,6 +221,11 @@ services-auth-admin-api:
     LOG_LEVEL: 'info'
     NODE_OPTIONS: '--max-old-space-size=691 -r dd-trace/init'
     SERVERSIDE_FEATURES_ON: 'driving-license-use-v1-endpoint-for-v2-comms'
+    XROAD_NATIONAL_REGISTRY_ACTOR_TOKEN: 'true'
+    XROAD_NATIONAL_REGISTRY_REDIS_NODES: '["clustercfg.general-redis-cluster-group.dnugi2.euw1.cache.amazonaws.com:6379"]'
+    XROAD_NATIONAL_REGISTRY_SERVICE_PATH: 'IS/GOV/6503760649/SKRA-Protected/Einstaklingar-v1'
+    XROAD_RSK_PROCURING_ACTOR_TOKEN: 'true'
+    XROAD_RSK_PROCURING_REDIS_NODES: '["clustercfg.general-redis-cluster-group.dnugi2.euw1.cache.amazonaws.com:6379"]'
   grantNamespaces:
     - 'nginx-ingress-external'
     - 'nginx-ingress-internal'
@@ -272,6 +279,8 @@ services-auth-admin-api:
     CLIENT_SECRET_ENCRYPTION_KEY: '/k8s/services-auth/admin-api/CLIENT_SECRET_ENCRYPTION_KEY'
     CONFIGCAT_SDK_KEY: '/k8s/configcat/CONFIGCAT_SDK_KEY'
     DB_PASS: '/k8s/servicesauth/DB_PASSWORD'
+    IDENTITY_SERVER_CLIENT_SECRET: '/k8s/services-auth/IDENTITY_SERVER_CLIENT_SECRET'
+    NATIONAL_REGISTRY_IDS_CLIENT_SECRET: '/k8s/xroad/client/NATIONAL-REGISTRY/IDENTITYSERVER_SECRET'
   securityContext:
     allowPrivilegeEscalation: false
     privileged: false

charts/identity-server/values.staging.yaml

@@ -213,6 +213,8 @@ namespaces:
 services-auth-admin-api:
   enabled: true
   env:
+    COMPANY_REGISTRY_REDIS_NODES: '["clustercfg.general-redis-cluster-group.ab9ckb.euw1.cache.amazonaws.com:6379"]'
+    COMPANY_REGISTRY_XROAD_PROVIDER_ID: 'IS-TEST/GOV/5402696029/Skatturinn/ft-v1'
     DB_HOST: 'postgres-applications.internal'
     DB_NAME: 'servicesauth'
     DB_REPLICAS_HOST: 'postgres-applications.internal'
@@ -222,6 +224,11 @@ services-auth-admin-api:
     LOG_LEVEL: 'info'
     NODE_OPTIONS: '--max-old-space-size=691 -r dd-trace/init'
     SERVERSIDE_FEATURES_ON: ''
+    XROAD_NATIONAL_REGISTRY_ACTOR_TOKEN: 'true'
+    XROAD_NATIONAL_REGISTRY_REDIS_NODES: '["clustercfg.general-redis-cluster-group.ab9ckb.euw1.cache.amazonaws.com:6379"]'
+    XROAD_NATIONAL_REGISTRY_SERVICE_PATH: 'IS-TEST/GOV/6503760649/SKRA-Protected/Einstaklingar-v1'
+    XROAD_RSK_PROCURING_ACTOR_TOKEN: 'true'
+    XROAD_RSK_PROCURING_REDIS_NODES: '["clustercfg.general-redis-cluster-group.ab9ckb.euw1.cache.amazonaws.com:6379"]'
   grantNamespaces:
     - 'nginx-ingress-external'
     - 'nginx-ingress-internal'
@@ -275,6 +282,8 @@ services-auth-admin-api:
     CLIENT_SECRET_ENCRYPTION_KEY: '/k8s/services-auth/admin-api/CLIENT_SECRET_ENCRYPTION_KEY'
     CONFIGCAT_SDK_KEY: '/k8s/configcat/CONFIGCAT_SDK_KEY'
     DB_PASS: '/k8s/servicesauth/DB_PASSWORD'
+    IDENTITY_SERVER_CLIENT_SECRET: '/k8s/services-auth/IDENTITY_SERVER_CLIENT_SECRET'
+    NATIONAL_REGISTRY_IDS_CLIENT_SECRET: '/k8s/xroad/client/NATIONAL-REGISTRY/IDENTITYSERVER_SECRET'
   securityContext:
     allowPrivilegeEscalation: false
     privileged: false

libs/api/domains/auth-admin/src/lib/auth-admin.module.ts

@@ -13,10 +13,13 @@ import { ClientSecretLoader } from './client/client-secret.loader'
 import { ScopeResolver } from './scope/scope.resolver'
 import { ScopeService } from './scope/scope.service'
 import { DelegationProviderService } from './delegationProvider/delegation-provider.service'
-import { DelegationProviderResolverResolver } from './delegationProvider/delegation-provider.resolver'
+import { DelegationProviderResolver } from './delegationProvider/delegation-provider.resolver'
+import { DelegationAdminResolver } from './delegationAdmin/delegation-admin.resolver'
+import { DelegationAdminService } from './delegationAdmin/delegation-admin.service'
+import { AuthDelegationApiClientModule } from '@island.is/clients/auth/delegation-api'
 
 @Module({
-  imports: [AuthAdminApiClientModule],
+  imports: [AuthAdminApiClientModule, AuthDelegationApiClientModule],
   providers: [
     TenantResolver,
     TenantEnvironmentResolver,
@@ -29,7 +32,9 @@ import { DelegationProviderResolverResolver } from './delegationProvider/delegat
     ScopeResolver,
     ScopeService,
     DelegationProviderService,
-    DelegationProviderResolverResolver,
+    DelegationProviderResolver,
+    DelegationAdminResolver,
+    DelegationAdminService,
   ],
 })
 export class AuthAdminModule {}