Add flag to indicate that a dialog should not be visible in portal GUIs such as arbeidsflate #2033

elsand · 2025-03-11T09:08:26Z

Introduction

Some dialogs are meant for API consumption only, and is not appropiate for GUIs such as arbeidsflate

Description

Altinn 3 instances can be configured to not have any "message box" representation, ie. not be visible in Altinn 2 Innboks. The Dialogporten Storage Adapter will consider this flag, and not make dialogs at all.

A need has been put forward from a service owner (not utilizing Altinn Studio) to similarly create dialogs referring to API services at its own platform and flag those such that they are not visible in Arbeidsflate. A mechanism to indicate that a given dialog is "API-only" could be used by the Storage Adapter as well, to allow EUS-es to still utilize the generic mechanisms via Dialogporten (eg. create/updated events).

Dialogs that are API-only should be easily filtered out by Arbeidsflate and similar systems, and should not require human-readable content (title and summary) to be set.

Implementation

This is likely most easily solved by a top-level bool flag, "isApiOnly", which is default false. Filtering should be a bool query parameter available on both SO and EU search endpoints, "ExcludeApiOnly" which is default false

All DTOs should include the flag.

Tasks

Threat Modelling

I have considered potential security risks (if risks were found, please list them below)

Acceptance criteria

Scenario: Filtering API-only dialogs in search results
GIVEN a request is made to search for dialogs
WHEN the query parameter ExcludeApiOnly=true is provided
THEN dialogs with isApiOnly=true are excluded from the results

Scenario: Retrieving API-only dialogs in search results
GIVEN a request is made to search for dialogs
WHEN the query parameter ExcludeApiOnly=false is provided (or omitted)
THEN dialogs with isApiOnly=true are included in the results

Scenario: Creating an API-only dialog
GIVEN a request is made to create a new dialog
WHEN the isApiOnly flag is set to true
THEN the dialog is stored with isApiOnly=true

Scenario: Updating an existing dialog to API-only
GIVEN an existing dialog with isApiOnly=false
WHEN it is updated with isApiOnly=true
THEN the updated dialog is stored with isApiOnly=true
(Requirement changed, flipping this flag not allowed)

Scenario: Preventing unnecessary content for API-only dialogs
GIVEN a new dialog is created with isApiOnly=true
WHEN no title or summary is provided
THEN the request is accepted and stored without requiring human-readable content

GIVEN a migration is run on an existing database
WHEN the schema is updated
THEN existing dialogs should have isApiOnly set to false by default

The text was updated successfully, but these errors were encountered:

MagnusSandgren · 2025-03-26T12:24:30Z

Fake news:

~~?apiOnly=true: Gi meg kun det som er api only~~
~~?apiOnly=true: Gi meg kun det som ikke er api only~~
~~? (ikke oppgi apiOnly): Jeg bryr meg ikke, gi meg begge.~~

Edit:

ExcludeApiOnly=true: Gi meg kun det som ikke er api only
ExcludeApiOnly=false: Gi meg begge (apiOnly=true/false)
ExcludeApiOnly=null: Gi meg begge (apiOnly=true/false)

## Description This change introduces a mechanism to indicate that a dialog is API-only, hiding it from portal systems aimed at humans. Key changes: - Add IsApiOnly boolean flag to dialog entity (default false), only for create - Added existing dialog lookup in update command validator - Add IncludeApiOnly query parameter to search endpoints (default true) - Make dialog- and transmission level content for API-only dialogs optional - Add database migration for new column - Add K6 tests to verify functionality ## Related Issue(s) * #2033 ## Verification - [x] **Your** code builds clean without any errors or warnings - [x] Manual testing done (required) - [x] Relevant automated test added (if you find this hard, leave it and we'll help out) ## Documentation - [ ] Documentation is updated (either in `docs`-directory, Altinnpedia or a separate linked PR in [altinn-studio-docs.](https://github.com/Altinn/altinn-studio-docs), if applicable) --------- Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: Ole Jørgen Skogstad <skogstad@softis.net> Co-authored-by: Magnus Sandgren <5285192+MagnusSandgren@users.noreply.github.com>

LeifHelstad · 2025-04-23T10:51:48Z

@elsand burde dette heller vært satt opp slik at GUIs som arbeidsflate slipper å forholde seg til disse. Slik jeg forstår det driver de nå i Altinn/dialogporten-frontend#2056 å oppdaterer ulike søk med "ExcludeApiOnly = true". Det betyr at et hvert frontend må ha dette kriteriet med i alle søk.
Burde ikke ekskluderingen være default?
Så får heller de som skal se disse gjøre et "includeApiOnly = true".

elsand · 2025-04-23T16:00:50Z

Nei, disse dialogene må være default inkludert mht til discoverability. Generiske GUI-er som Arbeidsflate er den minst utbredte typen SBS - det vil være vesentlige flere fagsystemer og andre integrasjoner som vil kunne ha interesse av denne type dialoger.

LeifHelstad · 2025-04-24T06:45:12Z

Mistenkte noe slikt. Legger merke til at du sider "det vil være" og ikke "det er". Så dette er noe man vil onboarde på, men som ikke er like utbredt i dag?

elsand · 2025-04-28T07:10:10Z

Så dette er noe man vil onboarde på, men som ikke er like utbredt i dag?

Stemmer, dette er såvidt meg bekjent ikke brukt av noen i dag.

LeifHelstad · 2025-05-05T08:38:57Z

Test (via arbeidsflate)

Arbeidsflate kan kun teste at de med false inkluderes og de med true eksluderes.
Det må kjøres en separat test for eksempel via Postman for verifisere alle varianter listet under "Acceptance Criteria".

Opprettet disse to:

Den med "isApiOnly": true fikk satt dette eksplistitt i opprettelses kallet
Den med "isApiOnly": false hadde ingen verdi satt i kallet men fikk denne som en default fra dialogporten.

I arbeidsflate vises nå kun den med "isApiOnly": false på grunn av filter excludeApiOnly implementert via Altinn/dialogporten-frontend#2056

{
    "items": [
        {
            "id": "01969f93-b48b-72df-9f27-2b862f01523d",
            "org": "digdir",
            "serviceResource": "urn:altinn:resource:super-simple-service",
            "serviceResourceType": "genericaccessresource",
            "party": "urn:altinn:person:identifier-no:23905497111",
            "guiAttachmentCount": 0,
            "createdAt": "2025-05-05T08:32:59.5313960Z",
            "updatedAt": "2025-05-05T08:32:59.5313960Z",
            "status": "New",
            "systemLabel": "Default",
            "isApiOnly": true,
            "content": {
                "title": {
                    "value": [
                        {
                            "value": "Dialog laget med Scenario Builder 2025-5-5 10:25 - Denne er isApiOnly=true",
                            "languageCode": "nb"
                        }
                    ],
                    "mediaType": "text/plain"
                },
                "summary": {
                    "value": [
                        {
                            "value": "Denne teksten representerer et sammendrag av dialogen, som er opprettet av serviceOwner i dialogporten.",
                            "languageCode": "nb"
                        }
                    ],
                    "mediaType": "text/plain"
                }
            }
        },
        {
            "id": "01969f90-0522-7431-9c0a-c2cc9741de26",
            "org": "digdir",
            "serviceResource": "urn:altinn:resource:super-simple-service",
            "serviceResourceType": "genericaccessresource",
            "party": "urn:altinn:person:identifier-no:23905497111",
            "guiAttachmentCount": 0,
            "createdAt": "2025-05-05T08:28:58.0183230Z",
            "updatedAt": "2025-05-05T08:28:58.0183230Z",
            "status": "New",
            "systemLabel": "Default",
            "isApiOnly": false,
            "content": {
                "title": {
                    "value": [
                        {
                            "value": "Dialog laget med Scenario Builder 2025-5-5 10:25",
                            "languageCode": "nb"
                        }
                    ],
                    "mediaType": "text/plain"
                },
                "summary": {
                    "value": [
                        {
                            "value": "Denne teksten representerer et sammendrag av dialogen, som er opprettet av serviceOwner i dialogporten.",
                            "languageCode": "nb"
                        }
                    ],
                    "mediaType": "text/plain"
                }
            }
        }

LeifHelstad · 2025-05-05T09:27:49Z

Test (via Postman)

TC-100 - Filtering API-only dialogs in search results

🟢 Test via arbeidsflate oppdatert med logikk for excludeApiOnly gir kun de med "isApiOnly": false
🔴 Dette kallet inkluderer rubbel og bit av både true og false:
- /api/v1/enduser/dialogs?Party=urn:altinn:person:identifier-no:23905497111&apiOnly=false

🟢 Dette kallet inkluderer kun de med false:

/api/v1/enduser/dialogs?Party=urn:altinn:person:identifier-no:23905497111&ExcludeApiOnly=true

TC-200 - Retrieving API-only dialogs in search results (by request)

~~🟢 Dette kallet inkluderer rubbel og bit av både true og false:~~
~~- /api/v1/enduser/dialogs?Party=urn:altinn:person:identifier-no:23905497111&apiOnly=true~~

🟢 Dette kallet inkluderer rubbel og bit av både true og false:

/api/v1/enduser/dialogs?Party=urn:altinn:person:identifier-no:23905497111&ExcludeApiOnly=false

TC-250 - Retrieving API-only dialogs in search results (default)

🟢 Test via Postman med gamle kall der parameter ikke amgis gir begge varianter (true og false) i retur.

TC-250 - Retrieving API-only dialogs in search results (don't care)

🟢 Å angi parameter spesifikt til null som i kommentar (ExcludeApiOnly=null: Gi meg begge (apiOnly=true/false))

/api/v1/enduser/dialogs?Party=urn:altinn:person:identifier-no:23905497111&ExcludeApiOnly=null
gir feilemlding "Value [null] is not valid for a [Boolean] property!"

TC-300 - Creating an API-only dialog

🟢 Å opprette en ny dialog med "isApiOnly":true, fungerer.
🟢 Å opprette en ny dialog med "isApiOnly":false, fungerer.

TC-400 - Updating an existing dialog to API-only (=negativ test, skal gi feilmelding)

🟡 Å gjøre UPDATE fra "isApiOnly": false til "isApiOnly": true medfører ingenting.

det aldri kommer noen feilmeldig om man forsøker, og andre felter som oppdateres samtidig oppdateres.

TC-500 - Preventing unnecessary content for API-only dialogs

🔴 Selv om "isApiOnly":true forlanger dialogporten:
"dto.content": [
"Title must not be empty.",
"Summary must not be empty."
]

LeifHelstad · 2025-05-05T09:29:00Z

@MagnusSandgren kan du se om denne er implenentert rett? Eller om jeg har tolket forventet resultat feil?

Scenario: Preventing unnecessary content for API-only dialogs
GIVEN a new dialog is created with isApiOnly=true
WHEN no title or summary is provided
THEN the request is accepted and stored without requiring human-readable content

Er det ment at selve parameteret alltid må være angitt men at de kan være tom streng eller null hvis isApiOnly=true

Problemet er det samme om man kun utelater en av de to som skal kunne utelates.

LeifHelstad · 2025-05-06T07:44:12Z

Oppdatert akseptkritere

Scenario: Preventing unnecessary content for API-only dialogs
GIVEN a new dialog is created with isApiOnly=true
WHEN no ~~title or summary~~ content parameter is provided
THEN the request is accepted and stored without requiring human-readable content

Test - TC 500

Negativ test - isApiOnly=false

Positiv test - isApiOnly=true

🟢 isApiOnly=true tillater at hele "content" sløyfes.
OBS! Hvis man ikke utelater content i sin helhet må både title og summary fylles ut.

elsand added this to Dialogporten / Arbeidsflate Mar 11, 2025

github-project-automation bot moved this to New issues in Dialogporten / Arbeidsflate Mar 11, 2025

github-project-automation bot added this to ⚠️ Dialogporten / Arbeidsflate - GAMMEL - se https://github.com/orgs/Altinn/projects/146 ⚠️ Mar 11, 2025

github-project-automation bot moved this to New issues in ⚠️ Dialogporten / Arbeidsflate - GAMMEL - se https://github.com/orgs/Altinn/projects/146 ⚠️ Mar 11, 2025

elsand moved this from New issues to Sprint Backlog in Dialogporten / Arbeidsflate Mar 11, 2025

elsand added the needs consideration Requires additional consideration label Mar 11, 2025

elsand moved this from Sprint Backlog to Doing in Dialogporten / Arbeidsflate Mar 18, 2025

elsand self-assigned this Mar 18, 2025

elsand mentioned this issue Mar 20, 2025

Implementere støtte for application.hideSettings #2075

Open

elsand removed the needs consideration Requires additional consideration label Apr 2, 2025

coderabbitai bot mentioned this issue Apr 3, 2025

feat: add IsApiOnly flag to dialogs #2043

Merged

4 tasks

oskogstad mentioned this issue Apr 17, 2025

Filtrer ut ApiOnly-dialoger Altinn/dialogporten-frontend#2056

Closed

elsand moved this from Doing to Testing in Dialogporten / Arbeidsflate Apr 28, 2025

elsand closed this as completed May 8, 2025

github-project-automation bot moved this from Testing to Done in Dialogporten / Arbeidsflate May 8, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add flag to indicate that a dialog should not be visible in portal GUIs such as arbeidsflate #2033

Add flag to indicate that a dialog should not be visible in portal GUIs such as arbeidsflate #2033

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Add flag to indicate that a dialog should not be visible in portal GUIs such as arbeidsflate #2033

Add flag to indicate that a dialog should not be visible in portal GUIs such as arbeidsflate #2033

Comments

Uh oh!

Introduction

Description

Implementation

Tasks

Threat Modelling

Acceptance criteria

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Test (via arbeidsflate)

Uh oh!

Uh oh!

Test (via Postman)

TC-100 - Filtering API-only dialogs in search results

TC-200 - Retrieving API-only dialogs in search results (by request)

TC-250 - Retrieving API-only dialogs in search results (default)

TC-250 - Retrieving API-only dialogs in search results (don't care)

TC-300 - Creating an API-only dialog

TC-400 - Updating an existing dialog to API-only (=negativ test, skal gi feilmelding)

TC-500 - Preventing unnecessary content for API-only dialogs

Uh oh!

Uh oh!

Uh oh!

Oppdatert akseptkritere

Test - TC 500

Negativ test - isApiOnly=false

Positiv test - isApiOnly=true

Uh oh!