feat(auth-admin): Delegation admin module

apps/portals/admin/src/auth.ts

@@ -38,6 +38,8 @@ if (userMocked) {
       AdminPortalScope.signatureCollectionProcess,
       AdminPortalScope.formSystem,
       AdminPortalScope.formSystemSuperUser,
+      AdminPortalScope.delegationSystem,
+      AdminPortalScope.delegationSystemAdmin,
     ],
     post_logout_redirect_uri: `${window.location.origin}`,
     userStorePrefix: 'ap.',

apps/portals/admin/src/lib/masterNavigation.ts

@@ -14,6 +14,7 @@ import { signatureCollectionNavigation } from '@island.is/portals/admin/signatur
 import { serviceDeskNavigation } from '@island.is/portals/admin/service-desk'
 import { petitionNavigation } from '@island.is/portals/admin/petition'
 import { formSystemNavigation } from '@island.is/form-system'
+import { delegationAdminNav } from 'delegation-admin'
 
 export const rootNavigationItem: PortalNavigationItem = {
   name: coreMessages.overview,
@@ -44,7 +45,10 @@ export const TOP_NAVIGATION: PortalNavigationItem = {
     serviceDeskNavigation,
     // Meðmælasöfnun
     signatureCollectionNavigation,
+    // Formakerfi
     formSystemNavigation,
+    // Aðgangsstýring umboð
+    delegationAdminNav,
   ],
 }
 export const BOTTOM_NAVIGATION: PortalNavigationItem = {

apps/portals/admin/src/lib/modules.ts

@@ -10,6 +10,7 @@ import { petitionModule } from '@island.is/portals/admin/petition'
 import { serviceDeskModule } from '@island.is/portals/admin/service-desk'
 import { signatureCollectionModule } from '@island.is/portals/admin/signature-collection'
 import { formSystemModule } from '@island.is/form-system'
+import { delegationAdminModule } from 'delegation-admin'
 
 /**
  * NOTE:
@@ -30,4 +31,5 @@ export const modules: PortalModule[] = [
   serviceDeskModule,
   signatureCollectionModule,
   formSystemModule,
+  delegationAdminModule,
 ]

apps/services/auth/admin-api/infra/auth-admin-api.ts

@@ -1,6 +1,20 @@
-import { json, service, ServiceBuilder } from '../../../../../infra/src/dsl/dsl'
+import { json, ref, service, ServiceBuilder } from '../../../../../infra/src/dsl/dsl'
 
-export const serviceSetup = (): ServiceBuilder<'services-auth-admin-api'> => {
+const REDIS_NODE_CONFIG = {
+  dev: json([
+    'clustercfg.general-redis-cluster-group.5fzau3.euw1.cache.amazonaws.com:6379',
+  ]),
+  staging: json([
+    'clustercfg.general-redis-cluster-group.ab9ckb.euw1.cache.amazonaws.com:6379',
+  ]),
+  prod: json([
+    'clustercfg.general-redis-cluster-group.dnugi2.euw1.cache.amazonaws.com:6379',
+  ]),
+}
+
+export const serviceSetup = (services: {
+  userNotification: ServiceBuilder<'user-notification'>
+}): ServiceBuilder<'services-auth-admin-api'> => {
   return service('services-auth-admin-api')
     .namespace('identity-server-admin')
     .image('services-auth-admin-api')
@@ -25,10 +39,34 @@ export const serviceSetup = (): ServiceBuilder<'services-auth-admin-api'> => {
         ]),
         prod: json(['https://innskra.island.is']),
       },
+      XROAD_NATIONAL_REGISTRY_ACTOR_TOKEN: 'true',
+      XROAD_RSK_PROCURING_ACTOR_TOKEN: 'true',
+      XROAD_NATIONAL_REGISTRY_SERVICE_PATH: {
+        dev: 'IS-DEV/GOV/10001/SKRA-Protected/Einstaklingar-v1',
+        staging: 'IS-TEST/GOV/6503760649/SKRA-Protected/Einstaklingar-v1',
+        prod: 'IS/GOV/6503760649/SKRA-Protected/Einstaklingar-v1',
+      },
+      XROAD_NATIONAL_REGISTRY_REDIS_NODES: REDIS_NODE_CONFIG,
+      XROAD_RSK_PROCURING_REDIS_NODES: REDIS_NODE_CONFIG,
+      USER_NOTIFICATION_API_URL: {
+        dev: ref((h) => `http://${h.svc(services.userNotification)}`),
+        staging: ref((h) => `http://${h.svc(services.userNotification)}`),
+        prod: 'https://user-notification.internal.island.is',
+      },
+      COMPANY_REGISTRY_XROAD_PROVIDER_ID: {
+        dev: 'IS-DEV/GOV/10006/Skatturinn/ft-v1',
+        staging: 'IS-TEST/GOV/5402696029/Skatturinn/ft-v1',
+        prod: 'IS/GOV/5402696029/Skatturinn/ft-v1',
+      },
+      COMPANY_REGISTRY_REDIS_NODES: REDIS_NODE_CONFIG,
     })
     .secrets({
       CLIENT_SECRET_ENCRYPTION_KEY:
         '/k8s/services-auth/admin-api/CLIENT_SECRET_ENCRYPTION_KEY',
+      IDENTITY_SERVER_CLIENT_SECRET:
+        '/k8s/services-auth/IDENTITY_SERVER_CLIENT_SECRET',
+      NATIONAL_REGISTRY_IDS_CLIENT_SECRET:
+        '/k8s/xroad/client/NATIONAL-REGISTRY/IDENTITYSERVER_SECRET',
     })
     .ingress({
       primary: {

apps/services/auth/admin-api/src/app/app.module.ts

@@ -3,6 +3,7 @@ import { ConfigModule } from '@nestjs/config'
 import { SequelizeModule } from '@nestjs/sequelize'
 
 import {
+  DelegationApiUserSystemNotificationConfig,
   DelegationConfig,
   SequelizeConfigService,
 } from '@island.is/auth-api-lib'
@@ -24,6 +25,12 @@ import { ClientSecretsModule } from './v2/secrets/client-secrets.module'
 import { TenantsModule } from './v2/tenants/tenants.module'
 import { ScopesModule } from './v2/scopes/scopes.module'
 import { ProvidersModule } from './v2/providers/providers.module'
+import { DelegationAdminModule } from './v2/delegations/delegation-admin.module'
+import { RskRelationshipsClientConfig } from '@island.is/clients-rsk-relationships'
+import { FeatureFlagConfig } from '@island.is/nest/feature-flags'
+import { IdsClientConfig, XRoadConfig } from '@island.is/nest/config'
+import { NationalRegistryClientConfig } from '@island.is/clients/national-registry-v2'
+import { CompanyRegistryConfig } from '@island.is/clients/rsk/company-registry'
 
 @Module({
   imports: [
@@ -46,9 +53,18 @@ import { ProvidersModule } from './v2/providers/providers.module'
     ProblemModule,
     ProvidersModule,
     ScopesModule,
+    DelegationAdminModule,
     ConfigModule.forRoot({
       isGlobal: true,
-      load: [DelegationConfig],
+      load: [
+        DelegationConfig,
+        RskRelationshipsClientConfig,
+        NationalRegistryClientConfig,
+        CompanyRegistryConfig,
+        FeatureFlagConfig,
+        XRoadConfig,
+        IdsClientConfig,
+      ],
       envFilePath: ['.env', '.env.secret'],
     }),
   ],

apps/services/auth/admin-api/src/app/v2/delegations/delegation-admin.controller.ts

@@ -0,0 +1,98 @@
+import {
+  Controller,
+  Delete,
+  Get,
+  Headers,
+  Param,
+  UseGuards,
+} from '@nestjs/common'
+import { ApiTags } from '@nestjs/swagger'
+
+import {
+  CurrentUser,
+  IdsUserGuard,
+  Scopes,
+  ScopesGuard,
+  User,
+} from '@island.is/auth-nest-tools'
+import {
+  DelegationAdminCustomDto,
+  DelegationAdminCustomService,
+} from '@island.is/auth-api-lib'
+import { Documentation } from '@island.is/nest/swagger'
+import { Audit, AuditService } from '@island.is/nest/audit'
+import { DelegationAdminScopes } from '@island.is/auth/scopes'
+import flatMap from 'lodash/flatMap'
+import { isDefined } from '@island.is/shared/utils'
+
+const namespace = '@island.is/auth/delegation-admin'
+
+@UseGuards(IdsUserGuard, ScopesGuard)
+@Scopes(DelegationAdminScopes.read)
+@ApiTags('delegation-admin')
+@Controller('delegation-admin')
+@Audit({ namespace })
+export class DelegationAdminController {
+  constructor(
+    private readonly delegationAdminService: DelegationAdminCustomService,
+    private readonly auditService: AuditService,
+  ) {}
+
+  @Get()
+  @Documentation({
+    response: { status: 200, type: DelegationAdminCustomDto },
+    request: {
+      header: {
+        'X-Query-National-Id': {
+          required: true,
+          description: 'fetch delegations for this national id',
+        },
+      },
+    },
+  })
+  @Audit<DelegationAdminCustomDto>({
+    resources: (delegation) =>
+      flatMap([
+        ...delegation.incoming.map((d) => d.id ?? undefined),
+        ...delegation.outgoing.map((d) => d.id ?? undefined),
+      ]).filter(isDefined),
+  })
+  async getDelegationAdmin(
+    @Headers('X-Query-National-Id') nationalId: string,
+  ): Promise<DelegationAdminCustomDto> {
+    return await this.delegationAdminService.getAllDelegationsByNationalId(
+      nationalId,
+    )
+  }
+
+  @Delete(':delegationId')
+  @Scopes(DelegationAdminScopes.amdin)
+  @Documentation({
+    response: { status: 204 },
+    request: {
+      params: {
+        delegationId: {
+          required: true,
+          description: 'The id of the delegation to delete',
+        },
+      },
+    },
+  })
+  delete(
+    @CurrentUser() user: User,
+    @Param('delegationId') delegationId: string,
+  ) {
+    return this.auditService.auditPromise(
+      {
+        auth: user,
+        namespace,
+        action: 'delete',
+        resources: delegationId,
+        meta: (deleted) => ({
+          deleted,
+        }),
+      },
+      this.delegationAdminService.deleteDelegation(user, delegationId),
+    )
+  }
+}

apps/services/auth/admin-api/src/app/v2/delegations/delegation-admin.module.ts

@@ -0,0 +1,12 @@
+import { Module } from '@nestjs/common'
+
+import { DelegationsModule as AuthDelegationsModule } from '@island.is/auth-api-lib'
+import { FeatureFlagModule } from '@island.is/nest/feature-flags'
+import { DelegationAdminController } from './delegation-admin.controller'
+
+@Module({
+  imports: [AuthDelegationsModule, FeatureFlagModule],
+  controllers: [DelegationAdminController],
+  providers: [],
+})
+export class DelegationAdminModule {}

libs/api/domains/auth-admin/src/lib/auth-admin.module.ts

@@ -13,10 +13,13 @@ import { ClientSecretLoader } from './client/client-secret.loader'
 import { ScopeResolver } from './scope/scope.resolver'
 import { ScopeService } from './scope/scope.service'
 import { DelegationProviderService } from './delegationProvider/delegation-provider.service'
-import { DelegationProviderResolverResolver } from './delegationProvider/delegation-provider.resolver'
+import { DelegationProviderResolver } from './delegationProvider/delegation-provider.resolver'
+import { DelegationAdminResolver } from './delegationAdmin/delegation-admin.resolver'
+import { DelegationAdminService } from './delegationAdmin/delegation-admin.service'
+import { AuthDelegationApiClientModule } from '@island.is/clients/auth/delegation-api'
 
 @Module({
-  imports: [AuthAdminApiClientModule],
+  imports: [AuthAdminApiClientModule, AuthDelegationApiClientModule],
   providers: [
     TenantResolver,
     TenantEnvironmentResolver,
@@ -29,7 +32,9 @@ import { DelegationProviderResolverResolver } from './delegationProvider/delegat
     ScopeResolver,
     ScopeService,
     DelegationProviderService,
-    DelegationProviderResolverResolver,
+    DelegationProviderResolver,
+    DelegationAdminResolver,
+    DelegationAdminService,
   ],
 })
 export class AuthAdminModule {}

libs/api/domains/auth-admin/src/lib/delegationAdmin/delegation-admin.resolver.ts

@@ -0,0 +1,111 @@
+import {
+  Args,
+  Mutation,
+  Parent,
+  Query,
+  ResolveField,
+  Resolver,
+} from '@nestjs/graphql'
+import { NotFoundException, UseGuards } from '@nestjs/common'
+
+import { DelegationAdminService } from './delegation-admin.service'
+import { DelegationAdminCustomModel } from './models/delegation.model'
+
+import { CurrentUser, IdsUserGuard, User } from '@island.is/auth-nest-tools'
+import {
+  Identity,
+  IdentityDataLoader,
+  IdentityLoader,
+} from '@island.is/api/domains/identity'
+import { Loader } from '@island.is/nest/dataloader'
+import { DelegationDTO } from '@island.is/auth-api-lib'
+import {
+  CustomDelegation,
+  Domain,
+  DomainDataLoader,
+  DomainLoader,
+  ISLAND_DOMAIN,
+} from '@island.is/api/domains/auth'
+
+@UseGuards(IdsUserGuard)
+@Resolver(CustomDelegation)
+export class DelegationAdminResolver {
+  constructor(
+    private readonly delegationAdminService: DelegationAdminService,
+  ) {}
+
+  @Query(() => DelegationAdminCustomModel, { name: 'authAdminDelegationAdmin' })
+  async getDelegationSystem(
+    @Args('nationalId') nationalId: string,
+    @CurrentUser() user: User,
+    @Loader(IdentityLoader) identityLoader: IdentityDataLoader,
+  ) {
+    const delegations = await this.delegationAdminService.getDelegationAdmin(
+      user,
+      nationalId,
+    )
+    const identityCard = await identityLoader.load(nationalId)
+
+    return {
+      nationalId: nationalId,
+      name: identityCard.name,
+      incoming: delegations.incoming,
+      outgoing: delegations.outgoing,
+    }
+  }
+
+  @Mutation(() => Boolean, { name: 'authDeleteAdminDelegation' })
+  async deleteDelegationSystem(
+    @Args('id') id: string,
+    @CurrentUser() user: User,
+  ) {
+    return this.delegationAdminService.deleteDelegationAdmin(user, id)
+  }
+
+  @ResolveField('from', () => Identity)
+  resolveFromIdentity(
+    @Loader(IdentityLoader) identityLoader: IdentityDataLoader,
+    @Parent() customDelegation: DelegationDTO,
+  ) {
+    return identityLoader.load(customDelegation.fromNationalId)
+  }
+
+  @ResolveField('to', () => Identity)
+  resolveToIdentity(
+    @Loader(IdentityLoader) identityLoader: IdentityDataLoader,
+    @Parent() customDelegation: DelegationDTO,
+  ) {
+    return identityLoader.load(customDelegation.toNationalId)
+  }
+
+  @ResolveField('validTo', () => Date, { nullable: true })
+  resolveValidTo(@Parent() delegation: DelegationDTO): Date | undefined {
+    if (!delegation.validTo) {
+      return undefined
+    }
+
+    return delegation.scopes?.every(
+      (scope) => scope.validTo?.toString() === delegation.validTo?.toString(),
+    )
+      ? delegation.validTo
+      : undefined
+  }
+
+  @ResolveField('domain', () => Domain)
+  async resolveDomain(
+    @Loader(DomainLoader) domainLoader: DomainDataLoader,
+    @Parent() delegation: DelegationDTO,
+  ): Promise<Domain> {
+    const domainName = delegation.domainName ?? ISLAND_DOMAIN
+    const domain = await domainLoader.load({
+      lang: 'is',
+      domain: domainName,
+    })
+
+    if (!domain) {
+      throw new NotFoundException(`Could not find domain: ${domainName}`)
+    }
+
+    return domain
+  }
+}