App Registration | Upload App Roles | 403 Forbidden | App manager is unable to register an App

[typecastcloud]

Current Behavior

API returns 403 error forbidden while uploading the required file.
https://portal-backend.entry.cofinity-x.com/api/apps/AppReleaseProcess/b6efcea6-d871-4f3c-a33b-0ea48a7a26ce/roles

Request Method:
GET

Status Code:
403 Forbidden

Expected Behavior

App Manager can upload App Roles document.

Steps To Reproduce

1. Login to portal as App manager
2. Navigate to App Management ---> App Release Process → Register you App
3. Create App and proceed the next steps
4. On Technical Integration, upload the User Role file
5. Hit “Upload App roles“

Finding

App Manager is missing the role: view_client_roles from Cl2-CX-Portal required to access GET endpoint https://portal-backend.entry.cofinity-x.com/api/apps/AppReleaseProcess/{appid}/roles

[evegufy]

Hi @typecastcloud thanks for reporting, I can reproduce the issue and yes, adding the role view_client_roles to App Manager would solve it.

The endpoint was introduced with our latest version (2.0.0):
https://github.com/eclipse-tractusx/portal-backend/pull/633/files#diff-01c4a6a7c5ebe2470acb750a3f512fe7694120e9285046443a9a916db3de244eR508

But the R&R concept doesn't cover it

@jjeroch was it simply missed to add t view_client_roles to App Manager in the the cx-central realm or is the authorization on the endpoint not correct?

[jjeroch]

Recheck done, this issue is (as already assumed by @evegufy) on the endpoint side.
view_clinet_roles is supposed to get used when it comes to actual role assignment. Since the App Manager is not supposed to assign roles to company users, the permission is not expected to be assigned.
Instead the permission of the following endpoints need to get switched

• GET /api/apps/AppChange/{appId}/roles => new permission validation edit_apps
• GET /api/apps/AppReleaseProcess/{appId}/roles => new permission validation add_apps

[typecastcloud]

Recheck done, this issue is (as already assumed by @evegufy) on the endpoint side. view_clinet_roles is supposed to get used when it comes to actual role assignment. Since the App Manager is not supposed to assign roles to company users, the permission is not expected to be assigned. Instead the permission of the following endpoints need to get switched

* GET /api/apps/AppChange/{appId}/roles => new permission validation `edit_apps`

* GET /api/apps/AppReleaseProcess/{appId}/roles => new permission validation `add_apps`

Thanks for the review!

@evegufy @jjeroch
Should I create an issue in portal-backend for this or is that already in work?

[typecastcloud]

I am not able to use this feature:
https://docs.github.com/en/issues/tracking-your-work-with-issues/transferring-an-issue-to-another-repository

[evegufy]

@tfjanjua and @typecastcloud thank for opening the issue in the portal backend, I think this one can be close then.

[typecastcloud]

New issue in portal-backend eclipse-tractusx/portal-backend#826