WIP for connection requests

oharsta · oharsta · commit 7d4ee664af77 · 2026-01-12T15:55:13.000+01:00
diff --git a/client/src/api/index.js b/client/src/api/index.js
@@ -303,11 +303,12 @@ export function deleteAllInvitations(organization) {
 }
 
 //IdentityProvider
-export function connectServiceProviderToIdentityProvider(applicationManageIdentifier, entityType, idpManageIdentifier) {
+export function connectServiceProviderToIdentityProvider(applicationManageIdentifier, entityType, idpManageIdentifier, message) {
     const body = {
         applicationManageIdentifier: applicationManageIdentifier,
         entityType: entityType,
-        idpManageIdentifier: idpManageIdentifier
+        idpManageIdentifier: idpManageIdentifier,
+        message
     };
     return postPutJson("/api/v1/idp/connect", body, "PUT")
 }
diff --git a/client/src/components/Entities.scss b/client/src/components/Entities.scss
@@ -125,15 +125,6 @@
         }
     }
 
-    svg.impersonate {
-        width: 26px;
-        height: auto;
-        cursor: pointer;
-        color: var(--sds--color--blue--400);
-
-    }
-
-
     table {
         width: 100%;
         table-layout: fixed;
@@ -290,6 +281,13 @@
                         height: auto;
                         color: var(--sds--color--gray--300);
                         border-radius: 12px;
+
+                        &.impersonate {
+                            width: 26px;
+                            height: auto;
+                            cursor: pointer;
+                            color: var(--sds--color--blue--400);
+                        }
                     }
                 }
 
diff --git a/client/src/locale/en.js b/client/src/locale/en.js
@@ -976,6 +976,7 @@ const en = {
         new: "Nieuwe applicatie toevoegen",
         name: "App",
         vendor: "Vendor",
+        connectRequested: "Requested",
         status: "Status",
         created: "Date connected",
         searchPlaceHolder: "Search...",
@@ -1022,11 +1023,25 @@ const en = {
     applicationConnect: {
         connect: "Connect",
         request: "Request connection",
+        requestMember: "Request application",
         back: "← Back to other apps",
         defaultAccess: "Hoe wil je default toegang instellen?",
+        requestConnection: "Koppeling met deze applicatie moet worden aangevraagd",
+        requestConnectionInfo: "De leverancier van deze applicatie ontvangt en beoordeelt de aanvraag. ",
         access: {
             all:"Iedereen van de {{orgName}} heeft direct automatisch toegang",
             some: "Pas toegangsregels toe"
+        },
+        memberRequestInfo: [
+            "Om een applicatie gekoppelde te krijgen met het SURF Access platform, moet akkoord gegeven worden worden door de SURF Access Verantwoordelijke van de {{orgName}}.",
+            "Geef hieronder aan waarom je deze applicatie geactiveerd wil hebben. Wij versturen het bericht naar hem of haar, je ontvangt zelf ook een kopie."
+        ],
+        messagePlaceholder: "Your message",
+        sendMessage: "Send message",
+        flash: {
+            requestConnectionByMember: "Your request has been send",
+            makeConnection: "Application access has been set",
+            requestConnection: "Application access is requested"
         }
     }
 }
diff --git a/client/src/pages/ApplicationDetail.jsx b/client/src/pages/ApplicationDetail.jsx
diff --git a/client/src/pages/ApplicationDetail.scss b/client/src/pages/ApplicationDetail.scss
@@ -16,6 +16,9 @@ div.application-detail-container {
             background-color: var(--sds--color--gray--background);
             border-radius: 6px;
         }
+        h3 {
+            margin-bottom: 20px;
+        }
     }
 
     .application-detail-header-container {
diff --git a/client/src/pages/ApplicationOverview.jsx b/client/src/pages/ApplicationOverview.jsx
@@ -3,10 +3,10 @@ import React, {useEffect, useState} from "react";
 import {publicServiceProviders} from "../api/index.js";
 import I18n from "../locale/I18n.js";
 import {useNavigate} from "react-router-dom";
-import {Loader} from "@surfnet/sds";
+import {Loader, Chip, ChipType} from "@surfnet/sds";
 import SelectField from "../components/SelectField.jsx";
 import {isEmpty} from "../utils/Utils.js";
-import {providerName, providerOrganizationName} from "../utils/Manage.js";
+import {CHANGE_REQUEST_TYPE, providerName, providerOrganizationName} from "../utils/Manage.js";
 import {useAppStore} from "../stores/AppStore.js";
 import {Entities} from "../components/Entities.jsx";
 import {isOrganizationAdmin} from "../utils/Permissions.js";
@@ -40,19 +40,24 @@ const ApplicationOverview = ({accessible}) => {
             publicServiceProviders()
                 .then(res => {
                     //Scope the services on the allowed-entities of the IdP of the user
+                    const openConnectionRequests = (user.changeRequests || [])
+                        .filter(changeRequest => changeRequest.requestType === CHANGE_REQUEST_TYPE.LINK_REQUEST &&
+                            changeRequest.pathUpdateType === "ADDITION")
+                        .map(changeRequest => changeRequest.pathUpdates.allowedEntities.name);
                     if (accessible) {
                         const allowedAll = user.identityProvider.data.allowedall;
                         const allowedEntities = user.identityProvider.data.allowedEntities.map(entity => entity.name);
-                        res = res.filter(entity => allowedAll || allowedEntities.includes(entity.data.entityid))
+                        res = res.filter(entity => allowedAll || allowedEntities.includes(entity.data.entityid) || openConnectionRequests.includes(entity.data.entityid))
                     } else {
                         //In the case of eduID / external user, we don't have an identityProvider
                         const allowedEntities = (user.identityProvider?.data?.allowedEntities || []).map(entity => entity.name);
-                        res = res.filter(entity => !allowedEntities.includes(entity.data.entityid))
+                        res = res.filter(entity => !allowedEntities.includes(entity.data.entityid) && !openConnectionRequests.includes(entity.data.entityid))
                     }
                     res.forEach(entity => {
                         entity.name = providerName(I18n.locale, entity);
                         entity.vendor = providerOrganizationName(I18n.locale, entity);
                         entity.created = entity.revision.created
+                        entity.connectionRequest = openConnectionRequests.includes(entity.data.entityid);
                     });
                     res = res
                         .sort((sp1, sp2) => sp1.name.toLowerCase()
@@ -166,7 +171,9 @@ const ApplicationOverview = ({accessible}) => {
             {
                 key: "name",
                 header: I18n.t("accessibleApps.name"),
-                mapper: entity => entity.name
+                mapper: entity => <div className="app-name">
+                    {entity.name}{entity.connectionRequest && <Chip type={ChipType.Status_error}
+                                                                    label={I18n.t("accessibleApps.connectRequested")}/>}</div>
             },
             {
                 key: "vendor",
diff --git a/client/src/pages/ApplicationOverview.scss b/client/src/pages/ApplicationOverview.scss
@@ -24,6 +24,13 @@ div.accessible-apps-container {
         }
     }
 
+    .app-name {
+        display: flex;
+        button {
+            margin: 0 15px 0 auto;
+        }
+    }
+
     .accessible-apps-header-container {
         background-color: var(--sds--color--gray--background);
         padding: 25px 50px 25px 50px;
diff --git a/client/src/stores/AppStore.js b/client/src/stores/AppStore.js
@@ -14,7 +14,7 @@ export const useAppStore = create(set => ({
     setFlash: (message, type) => {
         set({flash: {msg: message, type: type || "info"}});
         if (!type || type === "info") {
-            setTimeout(() => set({flash: {}}), 5000);
+            setTimeout(() => set({flash: {}}), 6500);
         }
     },
     clearFlash: () => set({flash: {}}),
diff --git a/client/src/utils/Manage.js b/client/src/utils/Manage.js
@@ -61,6 +61,15 @@ export const ENVIRONMENTS = {
     TEST: "TEST", PROD: "PROD"
 }
 
+export const CHANGE_REQUEST_TYPE = {
+    PRODUCTION_STATUS_REQUEST: "ProductionStatusRequest",
+    LINK_REQUEST: "LinkRequest",
+    UNLINK_REQUEST:"UnlinkRequest",
+    CHANGE:"Change",
+    LINK_INVITE:"LinkInvite",
+    UNLINK_INVITE: "UnlinkInvite"
+}
+
 export const APPLICATION_LINKS = [
     {
         locale: "applicationDetail.website",
diff --git a/server/src/main/java/access/api/IdentityProviderController.java b/server/src/main/java/access/api/IdentityProviderController.java
@@ -24,6 +24,7 @@
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
 
+import java.util.ArrayList;
 import java.util.List;
 import java.util.Map;
 
@@ -93,6 +94,9 @@ public ResponseEntity<Map<String, Object>> connect(User user, @RequestBody @Vali
             String deeplink = String.format("/application-detail/%s/%s",
                     serviceProvider.get("type"),
                     serviceProvider.get("id"));
+            //Avoid UnsupportedException for immutable collections
+            admins = new ArrayList<>(admins);
+            admins.add(user);
             mailBox.sendConnectionRequest(userFromDB, admins, organization, getProviderName(serviceProvider),
                     connectionRequest.getMessage(), deeplink);
             return Results.createResult();
diff --git a/server/src/main/java/access/api/UserController.java b/server/src/main/java/access/api/UserController.java
@@ -103,6 +103,8 @@ public ResponseEntity<User> me(@Parameter(hidden = true) User user, Authenticati
             userFromDB.setIdentityProvider(identityProvider);
             String obtainedAcr = (String) claims.getOrDefault("acr", "urn:oasis:names:tc:SAML:2.0:ac:classes:Password");
             userFromDB.setLoaLevel(this.convertLoaLevel(obtainedAcr));
+            List<Map<String, Object>> changeRequests = manage.getChangeRequestsIdentityProvider(identityProvider);
+            userFromDB.setChangeRequests(changeRequests);
 
             // Provision the user into the organization, if no organization is created yet, create it on the fly
             if (userFromDB.getOrganizationMemberships().stream()
diff --git a/server/src/main/java/access/model/OrganizationMembership.java b/server/src/main/java/access/model/OrganizationMembership.java
@@ -74,6 +74,7 @@ public Map<String, Serializable> getOrganizationInfo() {
         if (organization != null && Hibernate.isInitialized(organization)) {
             organizationInfo.put("id", organization.getId());
             organizationInfo.put("name", organization.getName());
+            organizationInfo.put("manageIdentifier", organization.getManageIdentifier());
             organizationInfo.put("status", organization.getStatus());
             organizationInfo.put("schacHomeOrganization", organization.getSchacHomeOrganization());
         }
diff --git a/server/src/main/java/access/model/User.java b/server/src/main/java/access/model/User.java
@@ -89,6 +89,9 @@ public class User implements Serializable, NameHolder {
     @Transient
     private Map<String, Object> identityProvider = null;
 
+    @Transient
+    private List<Map<String, Object>> changeRequests = null;
+
     @Transient
     private int loaLevel = 1;
 
@@ -242,4 +245,9 @@ public int getLoaLevel() {
     public boolean isExternalUser() {
         return externalUser;
     }
+
+    @JsonProperty
+    public List<Map<String, Object>> getChangeRequests() {
+        return changeRequests;
+    }
 }
diff --git a/server/src/test/java/access/api/IdentityProviderControllerTest.java b/server/src/test/java/access/api/IdentityProviderControllerTest.java
@@ -85,7 +85,7 @@ void memberConnectionRequestSupperUserRecipientFallback() {
         MimeMessageParser messageParser = super.mailMessage();
         List<String> recipients = messageParser.getTo().stream().map(address -> address.toString()).sorted().toList();
         //select email from users where super_user = 1
-        assertEquals(List.of("david.doe@example.com", "mos.doe@example.com"), recipients);
+        assertEquals(List.of("david.doe@example.com", "ex.doe@eduid.nl", "mos.doe@example.com"), recipients);
         String htmlContent = messageParser.getHtmlContent();
         assertTrue(htmlContent.contains("has requested to connect service Storage EN to your organization ShareLogics"));
     }
@@ -136,6 +136,7 @@ void memberConnectionRequestNotFound() {
                 .then()
                 .statusCode(404);
     }
+
     @SneakyThrows
     @Test
     void adminConnectionRequest() {
diff --git a/server/src/test/java/access/api/UserControllerTest.java b/server/src/test/java/access/api/UserControllerTest.java
@@ -26,7 +26,10 @@ class UserControllerTest extends AbstractTest {
     void meWithOauth2Login() throws Exception {
         this.stubForStats();
         AccessCookieFilter accessCookieFilter = openIDConnectFlow("/api/v1/users/me", ADMIN_SUB);
-        stubForIdentityProviderByEntityId("http://mock-idp");
+
+        super.stubForIdentityProviderByEntityId("http://mock-idp");
+        super.stubForGetChangeRequests(getChangeRequests());
+
         User user = given()
                 .when()
                 .filter(accessCookieFilter.cookieFilter())
@@ -52,7 +55,8 @@ void meManagerWithOauth2Login() throws Exception {
                 MANAGE_SUB, (UserInfoEnhancer)
                         userInfo -> userInfo.put("email", "changed.doe@example.com")
         );
-        stubForIdentityProviderByEntityId("http://mock-idp");
+        super.stubForIdentityProviderByEntityId("http://mock-idp");
+        super.stubForGetChangeRequests(getChangeRequests());
 
         User user = given()
                 .when()
@@ -90,7 +94,8 @@ void deleteUser() throws Exception {
     @Test
     void meManagerWithMockLogin() {
         AccessCookieFilter accessCookieFilter = mockLoginFlow(MANAGE_SUB);
-        stubForIdentityProviderByEntityId("http://mock-idp");
+        super.stubForIdentityProviderByEntityId("http://mock-idp");
+        super.stubForGetChangeRequests(getChangeRequests());
 
         User user = given()
                 .when()
@@ -235,7 +240,9 @@ void meNewUserWithExistingOrganizationTestLogin() {
                 "schac_home_organization", "sharelogics.org",
                 "sub", "urn:collab:person:providence:new");
         AccessCookieFilter accessCookieFilter = mockLoginFlow(attributes);
-        stubForIdentityProviderByEntityId("http://mock-idp");
+
+        super.stubForIdentityProviderByEntityId("http://mock-idp");
+        super.stubForGetChangeRequests(getChangeRequests());
 
         User user = given()
                 .when()
@@ -255,6 +262,7 @@ void meNewUserWithExistingOrganizationTestLogin() {
     @Test
     void createOrganizationForInstitutionAdmin() throws Exception {
         super.stubForIdentityProviderByInstitutionalGUID(ORGANISATION_GUID);
+        super.stubForGetChangeRequests(getChangeRequests());
 
         AccessCookieFilter accessCookieFilter = openIDConnectFlow("/api/v1/users/me", "new_institution_admin",
                 institutionalAdminEntitlementOperator(ORGANISATION_GUID));

Original file line number	Diff line number	Diff line change
`@@ -303,11 +303,12 @@ export function deleteAllInvitations(organization) {`
`303`	`303`	`}`
`304`	`304`
`305`	`305`	`//IdentityProvider`
`306`		`-export function connectServiceProviderToIdentityProvider(applicationManageIdentifier, entityType, idpManageIdentifier) {`
	`306`	`+export function connectServiceProviderToIdentityProvider(applicationManageIdentifier, entityType, idpManageIdentifier, message) {`
`307`	`307`	`const body = {`
`308`	`308`	`applicationManageIdentifier: applicationManageIdentifier,`
`309`	`309`	`entityType: entityType,`
`310`		`- idpManageIdentifier: idpManageIdentifier`
	`310`	`+ idpManageIdentifier: idpManageIdentifier,`
	`311`	`+ message`
`311`	`312`	`};`
`312`	`313`	`return postPutJson("/api/v1/idp/connect", body, "PUT")`
`313`	`314`	`}`
Original file line number	Diff line number	Diff line change
`@@ -16,6 +16,9 @@ div.application-detail-container {`
`16`	`16`	`background-color: var(--sds--color--gray--background);`
`17`	`17`	`border-radius: 6px;`
`18`	`18`	`}`
	`19`	`+ h3 {`
	`20`	`+ margin-bottom: 20px;`
	`21`	`+ }`
`19`	`22`	`}`
`20`	`23`
`21`	`24`	`.application-detail-header-container {`
Original file line number	Diff line number	Diff line change
`@@ -24,6 +24,13 @@ div.accessible-apps-container {`
`24`	`24`	`}`
`25`	`25`	`}`
`26`	`26`
	`27`	`+ .app-name {`
	`28`	`+ display: flex;`
	`29`	`+ button {`
	`30`	`+ margin: 0 15px 0 auto;`
	`31`	`+ }`
	`32`	`+ }`
	`33`	`+`
`27`	`34`	`.accessible-apps-header-container {`
`28`	`35`	`background-color: var(--sds--color--gray--background);`
`29`	`36`	`padding: 25px 50px 25px 50px;`
Original file line number	Diff line number	Diff line change
`@@ -14,7 +14,7 @@ export const useAppStore = create(set => ({`
`14`	`14`	`setFlash: (message, type) => {`
`15`	`15`	`set({flash: {msg: message, type: type \|\| "info"}});`
`16`	`16`	`if (!type \|\| type === "info") {`
`17`		`- setTimeout(() => set({flash: {}}), 5000);`
	`17`	`+ setTimeout(() => set({flash: {}}), 6500);`
`18`	`18`	`}`
`19`	`19`	`},`
`20`	`20`	`clearFlash: () => set({flash: {}}),`