WIP

back/apps/core-fca-low/src/controllers/interaction.controller.spec.ts

@@ -395,7 +395,7 @@ describe("InteractionController", () => {
       const res: Partial<Response> = { redirect: jest.fn() };
       const userSessionService = {
         get: jest.fn().mockReturnValue({
-          spIdentity: { sub: "user1" },
+          spIdentity: { sub: "user1", roles: ["agent_public"] },
           interactionId: "interaction123",
           idpAcr: "high",
           spEssentialAcr: "high",
@@ -443,7 +443,7 @@ describe("InteractionController", () => {
       const res = {} as Response;
       const userSessionService = {
         get: jest.fn().mockReturnValue({
-          spIdentity: { sub: "user1" },
+          spIdentity: { sub: "user1", roles: ["agent_public"] },
           isSilentAuthentication: true,
           idpId: "idp123",
         }),
@@ -461,7 +461,7 @@ describe("InteractionController", () => {
       const res = { redirect: jest.fn() } as unknown as Response;
       const userSessionService = {
         get: jest.fn().mockReturnValue({
-          spIdentity: { sub: "user1" },
+          spIdentity: { sub: "user1", roles: ["agent_public"] },
           isSilentAuthentication: false,
           interactionId: "interaction123",
           idpId: "idp123",
@@ -483,7 +483,7 @@ describe("InteractionController", () => {
       const res = {} as Response;
       const userSessionService = {
         get: jest.fn().mockReturnValue({
-          spIdentity: { sub: "user1", roles: [] },
+          spIdentity: { sub: "user1", roles: ["agent_public"] },
           spId: "sp123",
           idpId: "idp123",
           idpIdentity: { is_service_public: false },
@@ -503,7 +503,7 @@ describe("InteractionController", () => {
       const res = {} as Response;
       const userSessionService = {
         get: jest.fn().mockReturnValue({
-          spIdentity: { sub: "user1" },
+          spIdentity: { sub: "user1", roles: ["agent_public"] },
           spId: "sp123",
           idpId: "idp123",
           idpIdentity: { is_service_public: false },
@@ -524,7 +524,7 @@ describe("InteractionController", () => {
       const res = {} as Response;
       const userSessionService = {
         get: jest.fn().mockReturnValue({
-          spIdentity: { sub: "user1" },
+          spIdentity: { sub: "user1", roles: ["agent_public"] },
           spEssentialAcr: "high",
           idpAcr: "low",
         }),

back/apps/core-fca-low/src/controllers/interaction.controller.ts

@@ -249,7 +249,7 @@ export class InteractionController {
     // is_service_public field is only provided by ProConnect Identité
     // any identity without an is_service_public field is considered to be from the public sector
     const isPrivateSectorIdentity = idpIdentity?.is_service_public === false;
-    const isRoleAgentPublic = !roles || roles.includes("agent_public");
+    const isRoleAgentPublic = roles.includes("agent_public");
     const doesNotAcceptPrivateSectorEmployees = spType === "public";
 
     if (
@@ -258,10 +258,8 @@ export class InteractionController {
     ) {
       this.logger.warn({
         code: "agent_public_role_mismatch",
-        roles,
-        is_service_public: idpIdentity?.is_service_public,
-        spType,
-        siret: idpIdentity?.siret,
+        isPrivateSectorIdentity,
+        isRoleAgentPublic,
       });
     }
     if (isPrivateSectorIdentity && doesNotAcceptPrivateSectorEmployees) {

back/apps/core-fca-low/src/dto/identity-for-sp.dto.ts

@@ -1,8 +1,8 @@
 import {
+  IsArray,
   IsDefined,
   IsEnum,
   IsObject,
-  IsOptional,
   IsString,
   MaxLength,
   MinLength,
@@ -35,6 +35,7 @@ export class IdentityForSpDto extends IdentityFromIdpDto {
   @IsString()
   idp_acr: string;
 
+  @IsArray()
   @IsEnum(
     [
       "dirigeant",
@@ -46,6 +47,5 @@ export class IdentityForSpDto extends IdentityFromIdpDto {
     ],
     { each: true },
   )
-  @IsOptional()
-  roles?: string[];
+  roles: string[];
 }

back/apps/core-fca-low/src/services/identity.sanitizer.spec.ts

@@ -160,6 +160,7 @@ describe("IdentitySanitizer", () => {
         sub,
         uid: "UID123",
         usual_name: "Doe",
+        roles: [],
       });
     });
 
@@ -174,6 +175,7 @@ describe("IdentitySanitizer", () => {
         usual_name: "Doe",
         uid: "UID123",
         siret: "12345678900007",
+        is_service_public: true,
       };
 
       config.get = jest.fn().mockReturnValue({
@@ -195,7 +197,6 @@ describe("IdentitySanitizer", () => {
         cachedOrganizationService.getCachedOrganizationBySiret,
       ).toHaveBeenCalledWith("12345678900007");
       expect(identityForSp.roles).toEqual(["agent_public"]);
-      expect(identityForSp.is_service_public).toBe(true);
     });
 
     it("should handle error when getCachedOrganizationBySiret throws", async () => {
@@ -229,10 +230,9 @@ describe("IdentitySanitizer", () => {
 
       expect(logger.error).toHaveBeenCalledWith({
         code: "identity-sanitizer-cached-organization-error",
-        error,
+        originalError: error,
       });
-      expect(result.roles).toBeUndefined();
-      expect(result.is_service_public).toBeUndefined();
+      expect(result.roles).toEqual([]);
     });
 
     it("should not throw CoreFcaInvalidIdentityException when phone number is invalid", async () => {

back/apps/core-fca-low/src/services/identity.sanitizer.ts

@@ -65,6 +65,7 @@ export class IdentitySanitizer {
     const { featureFetchOrganizationData } =
       this.config.get<ApiEntrepriseConfig>("ApiEntreprise");
 
+    identityForSp.roles = [];
     if (featureFetchOrganizationData && !!identityForSp.siret) {
       try {
         const cachedOrganization =
@@ -74,11 +75,10 @@ export class IdentitySanitizer {
         const roles =
           this.cachedOrganizationService.computeRoles(cachedOrganization);
         identityForSp.roles = roles;
-        identityForSp.is_service_public = roles.includes("agent_public");
       } catch (error) {
         this.logger.error({
           code: "identity-sanitizer-cached-organization-error",
-          error,
+          originalError: error,
         });
       }
     }

back/libs/cached-organization/src/services/cached-organization.service.ts

@@ -20,13 +20,13 @@ export class CachedOrganizationService {
 
   computeRoles(cachedOrganization: CachedOrganization): string[] {
     const roles: string[] = [];
-    const isServicePublic = isPublicService({
-      cached_categorie_juridique: cachedOrganization.categorieJuridique,
-      cached_etat_administratif: cachedOrganization.etatAdministratif,
-      siret: cachedOrganization.siret,
-    });
-
-    if (isServicePublic) {
+    if (
+      isPublicService({
+        cached_categorie_juridique: cachedOrganization.categorieJuridique,
+        cached_etat_administratif: cachedOrganization.etatAdministratif,
+        siret: cachedOrganization.siret,
+      })
+    ) {
       roles.push("agent_public");
     }
 

back/libs/logger-plugins/src/services/logger-session.service.ts

@@ -60,6 +60,7 @@ export class LoggerSessionService implements LoggerPluginServiceInterface {
       spSiret: spIdentity?.siret,
       spSiretHint,
       spSub: spIdentity?.sub,
+      spRoles: spIdentity?.roles,
     };
 
     return context;