feat(ids-api): Use syslumenn api to verify delegation.

apps/services/auth/admin-api/src/app/app.module.ts

@@ -8,7 +8,13 @@ import {
   SequelizeConfigService,
 } from '@island.is/auth-api-lib'
 import { AuthModule } from '@island.is/auth-nest-tools'
+import { RskRelationshipsClientConfig } from '@island.is/clients-rsk-relationships'
+import { NationalRegistryClientConfig } from '@island.is/clients/national-registry-v2'
+import { CompanyRegistryConfig } from '@island.is/clients/rsk/company-registry'
+import { SyslumennClientConfig } from '@island.is/clients/syslumenn'
 import { AuditModule } from '@island.is/nest/audit'
+import { IdsClientConfig, XRoadConfig } from '@island.is/nest/config'
+import { FeatureFlagConfig } from '@island.is/nest/feature-flags'
 import { ProblemModule } from '@island.is/nest/problem'
 
 import { environment } from '../environments'
@@ -21,16 +27,11 @@ import { ResourcesModule } from './modules/resources/resources.module'
 import { TranslationModule } from './modules/translation/translation.module'
 import { UsersModule } from './modules/users/users.module'
 import { ClientsModule as ClientsV2Module } from './v2/clients/clients.module'
+import { DelegationAdminModule } from './v2/delegations/delegation-admin.module'
+import { ProvidersModule } from './v2/providers/providers.module'
+import { ScopesModule } from './v2/scopes/scopes.module'
 import { ClientSecretsModule } from './v2/secrets/client-secrets.module'
 import { TenantsModule } from './v2/tenants/tenants.module'
-import { ScopesModule } from './v2/scopes/scopes.module'
-import { ProvidersModule } from './v2/providers/providers.module'
-import { DelegationAdminModule } from './v2/delegations/delegation-admin.module'
-import { RskRelationshipsClientConfig } from '@island.is/clients-rsk-relationships'
-import { FeatureFlagConfig } from '@island.is/nest/feature-flags'
-import { IdsClientConfig, XRoadConfig } from '@island.is/nest/config'
-import { NationalRegistryClientConfig } from '@island.is/clients/national-registry-v2'
-import { CompanyRegistryConfig } from '@island.is/clients/rsk/company-registry'
 
 @Module({
   imports: [
@@ -64,6 +65,7 @@ import { CompanyRegistryConfig } from '@island.is/clients/rsk/company-registry'
         FeatureFlagConfig,
         XRoadConfig,
         IdsClientConfig,
+        SyslumennClientConfig,
       ],
       envFilePath: ['.env', '.env.secret'],
     }),

apps/services/auth/delegation-api/src/app/app.module.ts

@@ -7,9 +7,10 @@ import {
   SequelizeConfigService,
 } from '@island.is/auth-api-lib'
 import { AuthModule } from '@island.is/auth-nest-tools'
+import { RskRelationshipsClientConfig } from '@island.is/clients-rsk-relationships'
 import { NationalRegistryClientConfig } from '@island.is/clients/national-registry-v2'
 import { CompanyRegistryConfig } from '@island.is/clients/rsk/company-registry'
-import { RskRelationshipsClientConfig } from '@island.is/clients-rsk-relationships'
+import { SyslumennClientConfig } from '@island.is/clients/syslumenn'
 import { AuditModule } from '@island.is/nest/audit'
 import {
   ConfigModule,
@@ -50,6 +51,7 @@ import { ScopesModule } from './scopes/scopes.module'
         CompanyRegistryConfig,
         XRoadConfig,
         DelegationApiUserSystemNotificationConfig,
+        SyslumennClientConfig,
       ],
     }),
   ],

apps/services/auth/ids-api/infra/ids-api.ts

@@ -83,6 +83,8 @@ export const serviceSetup = (): ServiceBuilder<'services-auth-ids-api'> => {
         // Origin for Android prod app
         'android:apk-key-hash:EsLTUu5kaY7XPmMl2f7nbq4amu-PNzdYu3FecNf90wU',
       ]),
+      SYSLUMENN_HOST: '/k8s/api/SYSLUMENN_HOST', // todo: secret?
+      SYSLUMENN_TIMEOUT: '10000',
     })
     .secrets({
       IDENTITY_SERVER_CLIENT_SECRET:
@@ -92,6 +94,8 @@ export const serviceSetup = (): ServiceBuilder<'services-auth-ids-api'> => {
       NOVA_PASSWORD: '/k8s/services-auth/NOVA_PASSWORD',
       NATIONAL_REGISTRY_B2C_CLIENT_SECRET:
         '/k8s/services-auth/NATIONAL_REGISTRY_B2C_CLIENT_SECRET',
+      SYSLUMENN_USERNAME: '/k8s/services-auth/SYSLUMENN_USERNAME',
+      SYSLUMENN_PASSWORD: '/k8s/services-auth/SYSLUMENN_PASSWORD',
     })
     .xroad(Base, Client, RskProcuring, NationalRegistryAuthB2C)
     .readiness('/health/check')

apps/services/auth/ids-api/src/app/app.module.ts

@@ -11,6 +11,7 @@ import { RskRelationshipsClientConfig } from '@island.is/clients-rsk-relationshi
 import { NationalRegistryClientConfig } from '@island.is/clients/national-registry-v2'
 import { NationalRegistryV3ClientConfig } from '@island.is/clients/national-registry-v3'
 import { CompanyRegistryConfig } from '@island.is/clients/rsk/company-registry'
+import { SyslumennClientConfig } from '@island.is/clients/syslumenn'
 import { UserProfileClientConfig } from '@island.is/clients/user-profile'
 import { AuditModule } from '@island.is/nest/audit'
 import {
@@ -28,12 +29,12 @@ import { DelegationsModule } from './delegations/delegations.module'
 import { GrantsModule } from './grants/grants.module'
 import { LoginRestrictionsModule } from './login-restrictions/login-restrictions.module'
 import { NotificationsModule } from './notifications/notifications.module'
+import { PasskeysModule } from './passkeys/passkeys.module'
 import { PermissionsModule } from './permissions/permissions.module'
 import { ResourcesModule } from './resources/resources.module'
 import { TranslationModule } from './translation/translation.module'
 import { UserProfileModule } from './user-profile/user-profile.module'
 import { UsersModule } from './users/users.module'
-import { PasskeysModule } from './passkeys/passkeys.module'
 
 @Module({
   imports: [
@@ -68,6 +69,7 @@ import { PasskeysModule } from './passkeys/passkeys.module'
         PasskeysCoreConfig,
         NationalRegistryV3ClientConfig,
         smsModuleConfig,
+        SyslumennClientConfig,
       ],
     }),
   ],

apps/services/auth/ids-api/src/app/delegations/delegation-verification-result.dto.ts

@@ -0,0 +1,8 @@
+import { ApiProperty } from '@nestjs/swagger'
+import { IsBoolean } from 'class-validator'
+
+export class DelegationVerificationResult {
+  @IsBoolean()
+  @ApiProperty()
+  verified!: boolean
+}

apps/services/auth/ids-api/src/app/delegations/delegations.controller.ts

@@ -1,6 +1,7 @@
 import {
   Controller,
   Get,
+  Headers,
   Inject,
   ParseArrayPipe,
   Query,
@@ -27,6 +28,8 @@ import {
 import { LOGGER_PROVIDER } from '@island.is/logging'
 import { AuthDelegationType } from '@island.is/shared/types'
 
+import { DelegationVerificationResult } from './delegation-verification-result.dto'
+
 import type { Logger } from '@island.is/logging'
 import type { User } from '@island.is/auth-nest-tools'
 
@@ -110,4 +113,26 @@ export class DelegationsController {
       delegationType,
     )
   }
+
+  @Scopes('@identityserver.api/authentication')
+  @Get('verify')
+  @ApiOkResponse({ type: DelegationVerificationResult })
+  async verify(
+    @CurrentUser() user: User,
+    @Headers('X-Query-From-National-Id')
+    fromNationalId: string,
+    @Query('delegationType')
+    delegationType: AuthDelegationType[],
+  ): Promise<DelegationVerificationResult> {
+    if (!Array.isArray(delegationType)) delegationType = [delegationType]
+
+    const verified =
+      await this.delegationsIncomingService.verifyDelegationAtProvider(
+        user,
+        fromNationalId,
+        delegationType,
+      )
+
+    return { verified }
+  }
 }

apps/services/auth/ids-api/src/app/delegations/test/delegations-filters.spec.ts

@@ -15,7 +15,10 @@ import {
 import { createNationalRegistryUser } from '@island.is/testing/fixtures'
 import { TestApp, truncate } from '@island.is/testing/nest'
 
-import { setupWithAuth } from '../../../../test/setup'
+import {
+  nonExistingLegalRepresentativeNationalId,
+  setupWithAuth,
+} from '../../../../test/setup'
 import { testCases } from './delegations-filters-test-cases'
 import { user } from './delegations-filters-types'
 
@@ -128,4 +131,59 @@ describe('DelegationsController', () => {
       })
     },
   )
+
+  describe('verify', () => {
+    const testCase = testCases['legalRepresentative1']
+    testCase.user = user
+    const path = '/v1/delegations/verify'
+
+    beforeAll(async () => {
+      await truncate(sequelize)
+
+      await Promise.all(
+        testCase.domains.map((domain) => factory.createDomain(domain)),
+      )
+
+      await factory.createClient(testCase.client)
+
+      await Promise.all(
+        testCase.clientAllowedScopes.map((scope) =>
+          factory.createClientAllowedScope(scope),
+        ),
+      )
+
+      await Promise.all(
+        testCase.apiScopes.map((scope) => factory.createApiScope(scope)),
+      )
+
+      await factory.createDelegationIndexRecord({
+        fromNationalId: nonExistingLegalRepresentativeNationalId,
+        toNationalId: testCase.user.nationalId,
+        type: AuthDelegationType.LegalRepresentative,
+        provider: AuthDelegationProvider.DistrictCommissionersRegistry,
+      })
+    })
+
+    let res: request.Response
+    it(`GET ${path} returns verified response`, async () => {
+      res = await server
+        .get(path + `?delegationType=${AuthDelegationType.LegalRepresentative}`)
+        .set('X-Query-From-National-Id', testCase.fromLegalRepresentative[0])
+
+      expect(res.status).toEqual(200)
+      expect(res.body.verified).toEqual(true)
+    })
+
+    it(`GET ${path} returns non-verified response`, async () => {
+      res = await server
+        .get(path + `?delegationType=${AuthDelegationType.LegalRepresentative}`)
+        .set(
+          'X-Query-From-National-Id',
+          nonExistingLegalRepresentativeNationalId,
+        )
+
+      expect(res.status).toEqual(200)
+      expect(res.body.verified).toEqual(false)
+    })
+  })
 })

apps/services/auth/ids-api/src/app/delegations/test/delegations-scopes.spec.ts

@@ -22,12 +22,14 @@ const legalGuardianScopes = ['lg1', 'lg2']
 const procurationHolderScopes = ['ph1', 'ph2']
 const customScopes1 = ['cu1', 'cu2']
 const customScopes2 = ['cu3', 'cu4']
+const legalRepresentativeScopes = ['lr1', 'lr2']
 
 const apiScopes = [
   ...legalGuardianScopes,
   ...procurationHolderScopes,
   ...customScopes1,
   ...customScopes2,
+  ...legalRepresentativeScopes,
 ]
 
 const fromCustom = [
@@ -48,6 +50,9 @@ const supportedDelegationTypes = (scopeName: string): AuthDelegationType[] => {
   if (customScopes1.includes(scopeName) || customScopes2.includes(scopeName)) {
     result.push(AuthDelegationType.Custom)
   }
+  if (legalRepresentativeScopes.includes(scopeName)) {
+    result.push(AuthDelegationType.LegalRepresentative)
+  }
   return result
 }
 
@@ -98,6 +103,11 @@ const testCases: Record<string, TestCase> = {
     ],
     expected: [...legalGuardianScopes, ...identityResources],
   },
+  '7': {
+    fromNationalId: createNationalId('person'),
+    delegationType: [AuthDelegationType.LegalRepresentative],
+    expected: [...legalRepresentativeScopes, ...identityResources],
+  },
 }
 
 const user = createCurrentUser({

apps/services/auth/ids-api/test/setup.ts

@@ -12,6 +12,7 @@ import { RskRelationshipsClient } from '@island.is/clients-rsk-relationships'
 import { NationalRegistryClientService } from '@island.is/clients/national-registry-v2'
 import { NationalRegistryV3ClientService } from '@island.is/clients/national-registry-v3'
 import { CompanyRegistryClientService } from '@island.is/clients/rsk/company-registry'
+import { SyslumennService } from '@island.is/clients/syslumenn'
 import { V2MeApi } from '@island.is/clients/user-profile'
 import { FeatureFlagService, Features } from '@island.is/nest/feature-flags'
 import {
@@ -21,6 +22,7 @@ import {
 } from '@island.is/services/auth/testing'
 import {
   createCurrentUser,
+  createNationalId,
   createUniqueWords,
 } from '@island.is/testing/fixtures'
 import {
@@ -67,6 +69,8 @@ export const defaultScopes: Scopes = {
   },
 }
 
+export const nonExistingLegalRepresentativeNationalId = createNationalId()
+
 class MockNationalRegistryClientService
   implements Partial<NationalRegistryClientService>
 {
@@ -85,6 +89,13 @@ class MockUserProfile {
   meUserProfileControllerFindUserProfile = jest.fn().mockResolvedValue({})
 }
 
+class MockSyslumennService {
+  checkIfDelegationExists = jest.fn(
+    (_toNationalId: string, fromNationalId: string) =>
+      fromNationalId !== nonExistingLegalRepresentativeNationalId,
+  )
+}
+
 interface SetupOptions {
   user: User
   scopes?: Scopes
@@ -125,6 +136,8 @@ export const setupWithAuth = async ({
         .useValue({
           getIndividualRelationships: jest.fn().mockResolvedValue(null),
         })
+        .overrideProvider(SyslumennService)
+        .useClass(MockSyslumennService)
         .overrideProvider(FeatureFlagService)
         .useValue({
           getValue: (feature: Features) =>

apps/services/auth/personal-representative/src/app/app.module.ts

@@ -1,26 +1,29 @@
-import { RightTypesModule } from './modules/rightTypes/rightTypes.module'
-import { PersonalRepresentativesModule } from './modules/personalRepresentatives/personalRepresentatives.module'
-import { PersonalRepresentativeTypesModule } from './modules/personalRepresentativeTypes/personalRepresentativeTypes.module'
-import { AccessLogsModule } from './modules/accessLogs/accessLogs.module'
+import { Module } from '@nestjs/common'
+import { SequelizeModule } from '@nestjs/sequelize'
+
 import {
   DelegationConfig,
   SequelizeConfigService,
 } from '@island.is/auth-api-lib'
-import { Module } from '@nestjs/common'
-import { SequelizeModule } from '@nestjs/sequelize'
-import { environment } from '../environments'
-import { AuditModule } from '@island.is/nest/audit'
 import { AuthModule } from '@island.is/auth-nest-tools'
+import { RskRelationshipsClientConfig } from '@island.is/clients-rsk-relationships'
+import { NationalRegistryClientConfig } from '@island.is/clients/national-registry-v2'
+import { CompanyRegistryConfig } from '@island.is/clients/rsk/company-registry'
+import { SyslumennClientConfig } from '@island.is/clients/syslumenn'
+import { AuditModule } from '@island.is/nest/audit'
 import {
   ConfigModule,
   IdsClientConfig,
   XRoadConfig,
 } from '@island.is/nest/config'
-import { NationalRegistryClientConfig } from '@island.is/clients/national-registry-v2'
-import { CompanyRegistryConfig } from '@island.is/clients/rsk/company-registry'
-import { RskRelationshipsClientConfig } from '@island.is/clients-rsk-relationships'
 import { FeatureFlagConfig } from '@island.is/nest/feature-flags'
 
+import { environment } from '../environments'
+import { AccessLogsModule } from './modules/accessLogs/accessLogs.module'
+import { PersonalRepresentativesModule } from './modules/personalRepresentatives/personalRepresentatives.module'
+import { PersonalRepresentativeTypesModule } from './modules/personalRepresentativeTypes/personalRepresentativeTypes.module'
+import { RightTypesModule } from './modules/rightTypes/rightTypes.module'
+
 @Module({
   imports: [
     AuditModule.forRoot(environment.audit),
@@ -38,6 +41,7 @@ import { FeatureFlagConfig } from '@island.is/nest/feature-flags'
         CompanyRegistryConfig,
         XRoadConfig,
         FeatureFlagConfig,
+        SyslumennClientConfig,
       ],
     }),
     RightTypesModule,