feat: make auth configurable by mkilgus-at · Pull Request #38 · Arbeidstilsynet/receiver

mkilgus-at · 2026-03-12T09:42:59Z

No description provided.

…eat/authconfig

Copilot

Pull request overview

This PR introduces configurable authentication for the receiver API and moves the public “receive melding” POST endpoint to a new controller/path, alongside a major version bump and dependency/tooling updates.

Changes:

Add configurable auth toggle (DisableAuth) with Entra JWT bearer support when enabled.
Move POST /meldinger to POST /receive/melding (new ReceiveController) and remove the old POST from MeldingerController.
Update dependencies/tooling and document the breaking change (version bump + changelog/docs updates).

Reviewed changes

Copilot reviewed 23 out of 23 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
src/compose.yaml	Sets auth-disable flag for local docker compose runs.
src/Publish/Receiver.Publish/Receiver.Publish.csproj	Bumps package version to 2.0.0 and updates dependencies.
src/Publish/Receiver.Publish.Test/Receiver.Publish.Test.csproj	Updates test dependencies.
src/Publish/Receiver.Publish.Test.ArchUnit/Receiver.Publish.Test.ArchUnit.csproj	Updates ArchUnit + test dependencies.
src/Infrastructure/test/Infrastructure.Test.csproj	Updates test dependencies (incl. WireMock/Verify versions).
src/Infrastructure/src/Infrastructure.csproj	Updates infrastructure library dependencies.
src/Domain/Ports/Infrastructure/Domain.Ports.Infrastructure.csproj	Updates Altinn dependency version.
src/Domain/Logic/test/Domain.Logic.Test.csproj	Updates test dependencies.
src/Domain/Logic/src/Domain.Logic.csproj	Updates domain logic dependencies.
src/CHANGELOG.md	Documents the breaking endpoint move and version bump.
src/ArchUnit.Tests/ArchUnit.Tests.csproj	Updates ArchUnit + test dependencies.
src/App/test/App.Test.csproj	Updates app test dependencies.
src/App/src/appsettings.json	Renames auth setting key (but currently placed under root `Authentication`).
src/App/src/WebApi/Controllers/WebhookController.cs	Removes unused options injection from controller ctor.
src/App/src/WebApi/Controllers/ReceiveController.cs	Adds new authorized receive endpoint controller.
src/App/src/WebApi/Controllers/MeldingerController.cs	Removes old unauthenticated `POST` endpoint and keeps read endpoints.
src/App/src/Extensions/StartupExtensions.cs	Adds auth/authorization wiring and OpenAPI security behavior based on config.
src/App/src/AppSettings.cs	Renames/extends auth configuration model (DisableAuth + Entra settings).
src/App/src/App.csproj	Adds JwtBearer package reference and updates deps.
global.json	Updates pinned .NET SDK version.
documentation/configuration.md	Documents new auth-related configuration and endpoint guidance.
.config/dotnet-tools.json	Updates csharpier tool version.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

Copilot · 2026-03-12T09:49:29Z

 public class WebhookController(
    IMeldingService meldingService,
    IAltinnAdapter altinnAdapter,
-    IOptions<InfrastructureConfiguration> options,
    ApiMeters apiMeters
 ) : ControllerBase


After removing the IOptions<InfrastructureConfiguration> parameter, this file no longer uses Microsoft.Extensions.Options (and likely the Infrastructure.DependencyInjection import used only for InfrastructureConfiguration). Consider removing the now-unused using directives to keep the file clean.

Copilot · 2026-03-12T09:49:30Z

+            LoggerFactory
+                .Create(builder => builder.AddConsole())
+                .CreateLogger<Program>()
+                .LogWarning(
+                    "Authentication is disabled. Update AuthenticationConfiguration to require authentication."
+                );


This creates a new LoggerFactory with its own console provider, bypassing the app’s configured logging pipeline and potentially duplicating console logs. Prefer using the existing host logging (e.g., inject/use an ILogger from DI) to emit this warning.

Copilot · 2026-03-12T09:49:30Z

+                    "EntraClientId must be set either in appsettings when auth is enabled"
+                );
+            }
+            if (string.IsNullOrEmpty(tenantId))
+            {
+                throw new ArgumentException("EntraTenantId must be set when auth is enabled");
+            }
+            if (string.IsNullOrEmpty(scope))
+            {
+                throw new ArgumentException(
+                    "(Default) EntraScope must be set when auth is enabled, e.g. api://<my.app>/.default"


The thrown ArgumentException messages are a bit misleading/incomplete (e.g., they mention appsettings only, and don’t identify the offending parameter). Consider using clearer messages that reference the expected configuration keys/env vars and include paramName for easier diagnostics.

Suggested change

"EntraClientId must be set either in appsettings when auth is enabled"

);

}

if (string.IsNullOrEmpty(tenantId))

{

throw new ArgumentException("EntraTenantId must be set when auth is enabled");

}

if (string.IsNullOrEmpty(scope))

{

throw new ArgumentException(

"(Default) EntraScope must be set when auth is enabled, e.g. api://<my.app>/.default"

"AuthenticationConfiguration.EntraClientId must be set when authentication is enabled. " +

"Configure it in appsettings.json (AuthenticationConfiguration:EntraClientId) or via the " +

"'AuthenticationConfiguration__EntraClientId' environment variable.",

nameof(clientId)

);

}

if (string.IsNullOrEmpty(tenantId))

{

throw new ArgumentException(

"AuthenticationConfiguration.EntraTenantId must be set when authentication is enabled. " +

"Configure it in appsettings.json (AuthenticationConfiguration:EntraTenantId) or via the " +

"'AuthenticationConfiguration__EntraTenantId' environment variable.",

nameof(tenantId)

);

}

if (string.IsNullOrEmpty(scope))

{

throw new ArgumentException(

"AuthenticationConfiguration.EntraScope must be set when authentication is enabled, " +

"for example 'api://<my.app>/.default'. Configure it in appsettings.json " +

"(AuthenticationConfiguration:EntraScope) or via the " +

"'AuthenticationConfiguration__EntraScope' environment variable.",

nameof(scope)

…eat/authconfig

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

sonarqubecloud · 2026-03-12T10:10:50Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

at-bgp · 2026-03-12T11:27:35Z

+[Authorize]
+[ApiController]
+[Route("[controller]")]
+public class ReceiveController : ControllerBase


Er det meninga at det skal være receive? Altså uten '-r'?

at-bgp · 2026-03-12T11:31:32Z

            env.IsDevelopment()
        );

+        if (apiConfiguration.AuthenticationConfiguration.DisableAuth)


Lurer på om denne blocken er generell nok til at vi burde ha det i dotnet-common (AddOAuth(config) elns)

Arbeidstilsynet/dotnet-common#143
kanskje vi kan prøve å ferdigstille den her først

renovate Bot and others added 5 commits March 11, 2026 09:20

chore(deps): update all non-major dependencies

2c5a2bd

chore(deps): update dotnet monorepo

86bbfe6

chore(deps): update dependency wiremock.net to v2

9c1c38b

Merge remote-tracking branch 'origin/renovate/all-minor-patch' into f…

b911f5d

…eat/authconfig

feat: make authentication configurable

1f94f30

mkilgus-at requested review from at-bgp, Copilot and vaernion and removed request for Copilot March 12, 2026 09:43

mkilgus-at linked an issue Mar 12, 2026 that may be closed by this pull request

chore: protect POST endpoint with [Authorize] attribute to support entra id authentication if needed #32

Open

Copilot started reviewing on behalf of mkilgus-at March 12, 2026 09:43 View session

fix: tests

a9fabf5

Copilot AI review requested due to automatic review settings March 12, 2026 09:47

Copilot started reviewing on behalf of mkilgus-at March 12, 2026 09:47 View session

Copilot AI reviewed Mar 12, 2026

View reviewed changes

mkilgus-at and others added 6 commits March 12, 2026 10:49

Merge remote-tracking branch 'origin/renovate/dotnet-monorepo' into f…

ae17cf1

…eat/authconfig

Update src/CHANGELOG.md

be2ac1d

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update documentation/configuration.md

19f3e0e

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

fix: entra examples in config

6f884e6

fix: appsettings

f3782d1

fix: auth configuration keys

f4ee260

at-bgp reviewed Mar 12, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: make auth configurable#38

feat: make auth configurable#38
mkilgus-at wants to merge 12 commits intomainfrom
feat/authconfig

mkilgus-at commented Mar 12, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI Mar 12, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Mar 12, 2026

Uh oh!

Copilot AI Mar 12, 2026

Uh oh!

Uh oh!

sonarqubecloud Bot commented Mar 12, 2026

Uh oh!

at-bgp Mar 12, 2026 •

edited

Loading

Uh oh!

at-bgp Mar 12, 2026 •

edited

Loading

Uh oh!

mkilgus-at Mar 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

-                    "EntraClientId must be set either in appsettings when auth is enabled"
-                );
-            }
-            if (string.IsNullOrEmpty(tenantId))
-            {
-                throw new ArgumentException("EntraTenantId must be set when auth is enabled");
-            }
-            if (string.IsNullOrEmpty(scope))
-            {
-                throw new ArgumentException(
-                    "(Default) EntraScope must be set when auth is enabled, e.g. api://<my.app>/.default"
+                    "AuthenticationConfiguration.EntraClientId must be set when authentication is enabled. " +
+                    "Configure it in appsettings.json (AuthenticationConfiguration:EntraClientId) or via the " +
+                    "'AuthenticationConfiguration__EntraClientId' environment variable.",
+                    nameof(clientId)
+                );
+            }
+            if (string.IsNullOrEmpty(tenantId))
+            {
+                throw new ArgumentException(
+                    "AuthenticationConfiguration.EntraTenantId must be set when authentication is enabled. " +
+                    "Configure it in appsettings.json (AuthenticationConfiguration:EntraTenantId) or via the " +
+                    "'AuthenticationConfiguration__EntraTenantId' environment variable.",
+                    nameof(tenantId)
+                );
+            }
+            if (string.IsNullOrEmpty(scope))
+            {
+                throw new ArgumentException(
+                    "AuthenticationConfiguration.EntraScope must be set when authentication is enabled, " +
+                    "for example 'api://<my.app>/.default'. Configure it in appsettings.json " +
+                    "(AuthenticationConfiguration:EntraScope) or via the " +
+                    "'AuthenticationConfiguration__EntraScope' environment variable.",
+                    nameof(scope)

Conversation

mkilgus-at commented Mar 12, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Copilot AI Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sonarqubecloud Bot commented Mar 12, 2026

Quality Gate passed

Uh oh!

at-bgp Mar 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

at-bgp Mar 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mkilgus-at Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

at-bgp Mar 12, 2026 •

edited

Loading

at-bgp Mar 12, 2026 •

edited

Loading