feat: add ROLE_HELPDESK_INTEGRATION authority and middleware read/write permissions for req. endpoints - #1246
Open
ondraholis wants to merge 25 commits into
Open
feat: add ROLE_HELPDESK_INTEGRATION authority and middleware read/write permissions for req. endpoints#1246ondraholis wants to merge 25 commits into
ondraholis wants to merge 25 commits into
Conversation
added 17 commits
July 12, 2026 11:48
…rce state transitions
…zation, and resource lifecycle transitions
…sts and attachments
… ROLE_HELPDESK_INTEGRATION role
…igger and available events retrieval
added 8 commits
July 31, 2026 07:47
|
|
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a dedicated helpdesk integration authority/scope and wires it through Negotiator’s security model so a middleware service account can read/write the required negotiation resources and use machine tokens via Swagger.
Changes:
- Introduces
ROLE_HELPDESK_INTEGRATIONand maps thenegotiator_helpdeskOAuth2 scope to that role. - Extends read/write authorization in posts, negotiations, resource lifecycle transitions, and attachments for helpdesk integration.
- Updates Swagger/OpenAPI to support HTTP Bearer (JWT) auth, and adds test data + unit/integration tests for the new role.
Reviewed changes
Copilot reviewed 21 out of 21 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| oidc-server-config/clients.json | Adds a local dev/test client for helpdesk integration scope. |
| oidc-server-config/api-scopes.yaml | Registers the new negotiator_helpdesk scope. |
| oidc-server-config/api-resources.yaml | Associates the new scope with the Negotiator API resource for correct aud. |
| backend/src/test/java/eu/bbmri_eric/negotiator/unit/service/PostServiceTest.java | Adds unit coverage for helpdesk post creation behavior. |
| backend/src/test/java/eu/bbmri_eric/negotiator/unit/CustomJWTAuthConverterTest.java | Adds test asserting scope→role mapping for helpdesk. |
| backend/src/test/java/eu/bbmri_eric/negotiator/negotiation/NegotiationControllerTests.java | Extends controller tests to cover helpdesk access and new fixture negotiation. |
| backend/src/test/java/eu/bbmri_eric/negotiator/integration/service/NegotiationLifecycleServiceImplTest.java | Adds integration tests for helpdesk lifecycle events/permissions. |
| backend/src/test/java/eu/bbmri_eric/negotiator/integration/api/v3/PostControllerTests.java | Adds integration tests for helpdesk reading/creating posts. |
| backend/src/test/java/eu/bbmri_eric/negotiator/integration/api/v3/AttachmentControllerTests.java | Refactors attachment test setup and adds helpdesk download coverage. |
| backend/src/main/resources/db/test/migration/R__Initial_data.sql | Adds helpdesk test user + negotiation/resources/posts fixtures for integration tests. |
| backend/src/main/java/eu/bbmri_eric/negotiator/post/PostServiceImpl.java | Expands post read/write authorization to include helpdesk integration. |
| backend/src/main/java/eu/bbmri_eric/negotiator/post/PostController.java | Declares bearer auth requirement in API docs for machine tokens. |
| backend/src/main/java/eu/bbmri_eric/negotiator/negotiation/state_machine/resource/ResourceStateMachineConfig.java | Updates representative-secured transitions to allow helpdesk integration as well. |
| backend/src/main/java/eu/bbmri_eric/negotiator/negotiation/state_machine/resource/ResourceLifecycleServiceImpl.java | Extends security rule evaluation to allow helpdesk integration on representative transitions. |
| backend/src/main/java/eu/bbmri_eric/negotiator/negotiation/NegotiationServiceImpl.java | Allows helpdesk integration to pass negotiation authorization checks (used for attachments). |
| backend/src/main/java/eu/bbmri_eric/negotiator/negotiation/NegotiationController.java | Allows helpdesk integration to trigger resource lifecycle events. |
| backend/src/main/java/eu/bbmri_eric/negotiator/negotiation/NegotiationAccessManagerImpl.java | Grants helpdesk integration read access to negotiations/resources. |
| backend/src/main/java/eu/bbmri_eric/negotiator/common/configuration/SwaggerConfig.java | Adds bearerAuth scheme and attempts to enable it globally in OpenAPI. |
| backend/src/main/java/eu/bbmri_eric/negotiator/common/configuration/security/oauth2/CustomJWTAuthConverter.java | Maps negotiator_helpdesk scope to ROLE_HELPDESK_INTEGRATION. |
| backend/src/main/java/eu/bbmri_eric/negotiator/common/AuthenticatedUserContext.java | Adds helpdesk role constant + helper to detect helpdesk integration requests. |
| backend/src/main/java/eu/bbmri_eric/negotiator/attachment/AttachmentController.java | Declares bearer auth requirement in API docs for machine tokens. |
Comment on lines
83
to
+85
| .webhooks(webhookPaths) | ||
| .components(components); | ||
| .components(components) | ||
| .addSecurityItem(new SecurityRequirement().addList("security_auth").addList("bearerAuth")); |
Comment on lines
+383
to
+404
| @ParameterizedTest | ||
| @EnumSource(PostType.class) | ||
| @WithMockNegotiatorUser(authorities = "ROLE_HELPDESK_INTEGRATION") | ||
| public void test_createPublicAndPrivatePost_asHelpdeskIntegration_Ok(PostType postType) { | ||
| negotiation.setPublicPostsEnabled(true); | ||
| when(negotiationRepository.findById(any())).thenReturn(Optional.of(negotiation)); | ||
| when(personRepository.findById(any())).thenReturn(Optional.of(researcher)); | ||
| when(postRepository.save(any())).thenReturn(publicPost1); | ||
| PostCreateDTO postCreateDTO = | ||
| PostCreateDTO.builder().text(publicPost1.getText()).type(PostType.PUBLIC).build(); | ||
| PostDTO postDTO = | ||
| PostDTO.builder() | ||
| .id("test-id") | ||
| .createdBy(new UserResponseModel()) | ||
| .creationDate(LocalDateTime.now()) | ||
| .text(publicPost1.getText()) | ||
| .type(postType) | ||
| .build(); | ||
| when(modelMapper.map(publicPost1, PostDTO.class)).thenReturn(postDTO); | ||
| PostDTO returnedPostDTO = postService.create(postCreateDTO, negotiation.getId()); | ||
| assertEquals(postType, returnedPostDTO.getType()); | ||
| } |
Comment on lines
+171
to
+175
| } else if (securityRule.getAttributes().contains("isRepresentativeOrHelpdeskIntegration")) { | ||
| return AuthenticatedUserContext.isHelpdeskIntegration() | ||
| || personService.isRepresentativeOfAnyResource( | ||
| AuthenticatedUserContext.getCurrentlyAuthenticatedUserInternalId(), | ||
| List.of(resourceId)); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description:
Introduces the ROLE_HELPDESK_INTEGRATION Spring Security authority and negotiator_helpdesk OAuth2 scope required by the helpdesk middleware service account. This is Change 1 from the
helpdesk integration plan (helpdesk-integration-plan.md).
Changes to Negotiator authorization:
Changes to OIDC server config:
Changes to Swagger:
Checklist: