@digdir/dialogporten-schema 1.120.0 → 1.120.2-909cacd

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@digdir/dialogporten-schema",
-  "version": "1.120.0",
+  "version": "1.120.2-909cacd",
   "description": "GraphQl schema and OpenAPI spec for Dialogporten",
   "engines": {
     "node": "24"

package/schema.verified.graphql

@@ -48,6 +48,9 @@ type ApiAction {
   action: String!
   "Contains an authorization resource attributeId, that can used in custom authorization rules in the XACML service policy, which by default is the policy belonging to the service referred to by 'serviceResource' in the dialog. Can also be used to refer to other service policies."
   authorizationAttribute: String
+    @deprecated(
+      reason: "Use of 'authorizationContext' on the service owner API is preferred; this field only reflects the legacy authorization attribute."
+    )
   "True if the authenticated user is authorized for this action. If not, the action will not be available and all endpoints will be replaced with a fixed placeholder."
   isAuthorized: Boolean!
   "The logical name of the operation the API action refers to."
@@ -88,6 +91,8 @@ type Attachment {
   urls: [AttachmentUrl!]!
   "The UTC timestamp when the attachment expires and is no longer available."
   expiresAt: DateTime
+  "Indicates whether the authenticated user is authorized for this attachment. If not, the URLs will be replaced with 'urn:dialogporten:unauthorized'."
+  isAuthorized: Boolean!
 }
 
 type AttachmentUrl {
@@ -210,7 +215,7 @@ type Dialog {
   updatedAt: DateTime!
   "The date and time when the dialog content was last updated. Example: 2022-12-31T23:59:59Z"
   contentUpdatedAt: DateTime!
-  "The dialog token. May be used (if supported) against external URLs referred to in this dialog's apiActions, transmissions or attachments. It should also be used for front-channel embeds."
+  "The dialog token. May be used (if supported) against external URLs referred to in this dialog's apiActions, transmissions or attachments. It should also be used for front-channel embeds. The token's authorized entities ('e') claim lists, for every entity carrying an authorization context that the end user is authorized for, the entity's id or the 'tokenRef' the service owner supplied on the context. A tokenRef shared by multiple entities represents an OR-group: authorization for any group member adds the shared value. Recipients must validate the dialog id ('i') together with an entity reference."
   dialogToken: String
   "The aggregated status of the dialog."
   status: DialogStatus!
@@ -236,10 +241,16 @@ type Dialog {
   content: Content!
   "The attachments associated with the dialog (on an aggregate level)."
   attachments: [Attachment!]!
+  "Dialog-level attachments that exist but are withheld from the authenticated user, listed by id and creation time only. An attachment is excluded rather than shown with masked URLs when its authorization context sets unauthorizedPresentation to 'excluded'. Exclusions are reported per collection: the full set for a dialog is 'excludedAttachments', 'excludedTransmissions', 'excludedGuiActions' and 'excludedApiActions' on the dialog, plus 'excludedAttachments' and 'excludedNavigationalActions' on each transmission. Merge all six when answering 'what changed that I am not allowed to see?'; reading only one under-reports silently."
+  excludedAttachments: [ExcludedElement!]
   "The GUI actions associated with the dialog. Should be used in browser-based interactive frontends."
   guiActions: [GuiAction!]!
+  "GUI actions that exist but are withheld from the authenticated user, listed by id and creation time only. A GUI action is excluded rather than returned with isAuthorized=false when its authorization context sets unauthorizedPresentation to 'excluded'. Exclusions are reported per collection: the full set for a dialog is 'excludedAttachments', 'excludedTransmissions', 'excludedGuiActions' and 'excludedApiActions' on the dialog, plus 'excludedAttachments' and 'excludedNavigationalActions' on each transmission. Merge all six when answering 'what changed that I am not allowed to see?'; reading only one under-reports silently."
+  excludedGuiActions: [ExcludedElement!]
   "The API actions associated with the dialog. Should be used in specialized, non-browser-based integrations."
   apiActions: [ApiAction!]!
+  "API actions that exist but are withheld from the authenticated user, listed by id and creation time only. An API action is excluded rather than returned with isAuthorized=false when its authorization context sets unauthorizedPresentation to 'excluded'. Exclusions are reported per collection: the full set for a dialog is 'excludedAttachments', 'excludedTransmissions', 'excludedGuiActions' and 'excludedApiActions' on the dialog, plus 'excludedAttachments' and 'excludedNavigationalActions' on each transmission. Merge all six when answering 'what changed that I am not allowed to see?'; reading only one under-reports silently."
+  excludedApiActions: [ExcludedElement!]
   "An immutable list of activities associated with the dialog."
   activities: [Activity!]!
   "The list of seen log entries for the dialog newer than the dialog UpdatedAt date."
@@ -257,6 +268,8 @@ type Dialog {
   isContentSeen: Boolean!
   "The immutable list of transmissions associated with the dialog."
   transmissions: [Transmission!]!
+  "Transmissions that exist but are withheld from the authenticated user, listed by id and creation time only. A transmission is excluded rather than returned with isAuthorized=false when its authorization context sets unauthorizedPresentation to 'excluded'; its children go with it. Exclusions are reported per collection: the full set for a dialog is 'excludedAttachments', 'excludedTransmissions', 'excludedGuiActions' and 'excludedApiActions' on the dialog, plus 'excludedAttachments' and 'excludedNavigationalActions' on each transmission. Merge all six when answering 'what changed that I am not allowed to see?'; reading only one under-reports silently."
+  excludedTransmissions: [ExcludedElement!]
   "Metadata about the dialog owned by end-users."
   endUserContext: EndUserContext!
 }
@@ -369,6 +382,13 @@ type EndUserSearchLimits {
   maxExtendedStatusFilterValues: Int!
 }
 
+type ExcludedElement {
+  "The identifier of the excluded element, matching the id it would have had in its own collection."
+  id: UUID!
+  "The date and time when the excluded element was created. Lets a client order exclusions against the elements it can see, e.g. to tell where in a transmission thread something is missing."
+  createdAt: DateTime!
+}
+
 type GuiAction {
   "The unique identifier for the action in UUIDv7 format."
   id: UUID!
@@ -378,6 +398,9 @@ type GuiAction {
   url: URL!
   "Contains an authorization resource attributeId, that can used in custom authorization rules in the XACML service policy, which by default is the policy belonging to the service referred to by 'serviceResource' in the dialog. Can also be used to refer to other service policies."
   authorizationAttribute: String
+    @deprecated(
+      reason: "Use of 'authorizationContext' on the service owner API is preferred; this field only reflects the legacy authorization attribute."
+    )
   "Whether the user is authorized to perform the action."
   isAuthorized: Boolean!
   "Indicates whether the action results in the dialog being deleted. Used by frontends to implement custom UX for delete actions."
@@ -649,6 +672,9 @@ type Transmission {
   createdAt: DateTime!
   "Contains an authorization resource attributeId, that can used in custom authorization rules in the XACML service policy, which by default is the policy belonging to the service referred to by 'serviceResource' in the dialog. Can also be used to refer to other service policies. Example: mycustomresource, urn:altinn:subresource:mycustomresource, urn:altinn:task:Task_1, urn:altinn:resource:some-other-service-identifier"
   authorizationAttribute: String
+    @deprecated(
+      reason: "Use of 'authorizationContext' on the service owner API is preferred; this field only reflects the legacy authorization attribute."
+    )
   "Flag indicating if the authenticated user is authorized for this transmission. If not, embedded content and the attachments will not be available."
   isAuthorized: Boolean!
   "Arbitrary URI/URN describing a service-specific transmission type. Refer to the service-specific documentation provided by the service owner for details (if in use)."
@@ -667,8 +693,12 @@ type Transmission {
   content: TransmissionContent!
   "The transmission-level attachments."
   attachments: [Attachment!]!
+  "Attachments on this transmission that exist but are withheld from the authenticated user, listed by id and creation time only. An attachment is excluded rather than shown with masked URLs when its authorization context sets unauthorizedPresentation to 'excluded'. Exclusions are reported per collection: the full set for a dialog is 'excludedAttachments', 'excludedTransmissions', 'excludedGuiActions' and 'excludedApiActions' on the dialog, plus 'excludedAttachments' and 'excludedNavigationalActions' on each transmission. Merge all six when answering 'what changed that I am not allowed to see?'; reading only one under-reports silently."
+  excludedAttachments: [ExcludedElement!]
   "The transmission-level navigational actions."
   navigationalActions: [TransmissionNavigationalAction!]!
+  "Navigational actions on this transmission that exist but are withheld from the authenticated user, listed by id and creation time only. A navigational action is excluded rather than returned with isAuthorized=false when its authorization context sets unauthorizedPresentation to 'excluded'. Exclusions are reported per collection: the full set for a dialog is 'excludedAttachments', 'excludedTransmissions', 'excludedGuiActions' and 'excludedApiActions' on the dialog, plus 'excludedAttachments' and 'excludedNavigationalActions' on each transmission. Merge all six when answering 'what changed that I am not allowed to see?'; reading only one under-reports silently."
+  excludedNavigationalActions: [ExcludedElement!]
 }
 
 type TransmissionContent {
@@ -681,12 +711,16 @@ type TransmissionContent {
 }
 
 type TransmissionNavigationalAction {
+  "The unique identifier for the navigational action in UUIDv7 format."
+  id: UUID!
   "The title of the navigational action."
   title: [Localization!]!
   "The fully qualified URL of the navigational action. Will be set to 'urn:dialogporten:unauthorized' if the user is not authorized to access the transmission, or 'urn:dialogporten:expired' if the action has expired."
   url: URL!
   "The UTC timestamp when the navigational action expires and is no longer available."
   expiresAt: DateTime
+  "Indicates whether the authenticated user is authorized for this navigational action. If not, the URL will be replaced with 'urn:dialogporten:unauthorized'."
+  isAuthorized: Boolean!
 }
 
 interface BulkSetSystemLabelError {

package/src/index.js

@@ -48,6 +48,9 @@ type ApiAction {
   action: String!
   "Contains an authorization resource attributeId, that can used in custom authorization rules in the XACML service policy, which by default is the policy belonging to the service referred to by 'serviceResource' in the dialog. Can also be used to refer to other service policies."
   authorizationAttribute: String
+    @deprecated(
+      reason: "Use of 'authorizationContext' on the service owner API is preferred; this field only reflects the legacy authorization attribute."
+    )
   "True if the authenticated user is authorized for this action. If not, the action will not be available and all endpoints will be replaced with a fixed placeholder."
   isAuthorized: Boolean!
   "The logical name of the operation the API action refers to."
@@ -88,6 +91,8 @@ type Attachment {
   urls: [AttachmentUrl!]!
   "The UTC timestamp when the attachment expires and is no longer available."
   expiresAt: DateTime
+  "Indicates whether the authenticated user is authorized for this attachment. If not, the URLs will be replaced with 'urn:dialogporten:unauthorized'."
+  isAuthorized: Boolean!
 }
 
 type AttachmentUrl {
@@ -210,7 +215,7 @@ type Dialog {
   updatedAt: DateTime!
   "The date and time when the dialog content was last updated. Example: 2022-12-31T23:59:59Z"
   contentUpdatedAt: DateTime!
-  "The dialog token. May be used (if supported) against external URLs referred to in this dialog's apiActions, transmissions or attachments. It should also be used for front-channel embeds."
+  "The dialog token. May be used (if supported) against external URLs referred to in this dialog's apiActions, transmissions or attachments. It should also be used for front-channel embeds. The token's authorized entities ('e') claim lists, for every entity carrying an authorization context that the end user is authorized for, the entity's id or the 'tokenRef' the service owner supplied on the context. A tokenRef shared by multiple entities represents an OR-group: authorization for any group member adds the shared value. Recipients must validate the dialog id ('i') together with an entity reference."
   dialogToken: String
   "The aggregated status of the dialog."
   status: DialogStatus!
@@ -236,10 +241,16 @@ type Dialog {
   content: Content!
   "The attachments associated with the dialog (on an aggregate level)."
   attachments: [Attachment!]!
+  "Dialog-level attachments that exist but are withheld from the authenticated user, listed by id and creation time only. An attachment is excluded rather than shown with masked URLs when its authorization context sets unauthorizedPresentation to 'excluded'. Exclusions are reported per collection: the full set for a dialog is 'excludedAttachments', 'excludedTransmissions', 'excludedGuiActions' and 'excludedApiActions' on the dialog, plus 'excludedAttachments' and 'excludedNavigationalActions' on each transmission. Merge all six when answering 'what changed that I am not allowed to see?'; reading only one under-reports silently."
+  excludedAttachments: [ExcludedElement!]
   "The GUI actions associated with the dialog. Should be used in browser-based interactive frontends."
   guiActions: [GuiAction!]!
+  "GUI actions that exist but are withheld from the authenticated user, listed by id and creation time only. A GUI action is excluded rather than returned with isAuthorized=false when its authorization context sets unauthorizedPresentation to 'excluded'. Exclusions are reported per collection: the full set for a dialog is 'excludedAttachments', 'excludedTransmissions', 'excludedGuiActions' and 'excludedApiActions' on the dialog, plus 'excludedAttachments' and 'excludedNavigationalActions' on each transmission. Merge all six when answering 'what changed that I am not allowed to see?'; reading only one under-reports silently."
+  excludedGuiActions: [ExcludedElement!]
   "The API actions associated with the dialog. Should be used in specialized, non-browser-based integrations."
   apiActions: [ApiAction!]!
+  "API actions that exist but are withheld from the authenticated user, listed by id and creation time only. An API action is excluded rather than returned with isAuthorized=false when its authorization context sets unauthorizedPresentation to 'excluded'. Exclusions are reported per collection: the full set for a dialog is 'excludedAttachments', 'excludedTransmissions', 'excludedGuiActions' and 'excludedApiActions' on the dialog, plus 'excludedAttachments' and 'excludedNavigationalActions' on each transmission. Merge all six when answering 'what changed that I am not allowed to see?'; reading only one under-reports silently."
+  excludedApiActions: [ExcludedElement!]
   "An immutable list of activities associated with the dialog."
   activities: [Activity!]!
   "The list of seen log entries for the dialog newer than the dialog UpdatedAt date."
@@ -257,6 +268,8 @@ type Dialog {
   isContentSeen: Boolean!
   "The immutable list of transmissions associated with the dialog."
   transmissions: [Transmission!]!
+  "Transmissions that exist but are withheld from the authenticated user, listed by id and creation time only. A transmission is excluded rather than returned with isAuthorized=false when its authorization context sets unauthorizedPresentation to 'excluded'; its children go with it. Exclusions are reported per collection: the full set for a dialog is 'excludedAttachments', 'excludedTransmissions', 'excludedGuiActions' and 'excludedApiActions' on the dialog, plus 'excludedAttachments' and 'excludedNavigationalActions' on each transmission. Merge all six when answering 'what changed that I am not allowed to see?'; reading only one under-reports silently."
+  excludedTransmissions: [ExcludedElement!]
   "Metadata about the dialog owned by end-users."
   endUserContext: EndUserContext!
 }
@@ -369,6 +382,13 @@ type EndUserSearchLimits {
   maxExtendedStatusFilterValues: Int!
 }
 
+type ExcludedElement {
+  "The identifier of the excluded element, matching the id it would have had in its own collection."
+  id: UUID!
+  "The date and time when the excluded element was created. Lets a client order exclusions against the elements it can see, e.g. to tell where in a transmission thread something is missing."
+  createdAt: DateTime!
+}
+
 type GuiAction {
   "The unique identifier for the action in UUIDv7 format."
   id: UUID!
@@ -378,6 +398,9 @@ type GuiAction {
   url: URL!
   "Contains an authorization resource attributeId, that can used in custom authorization rules in the XACML service policy, which by default is the policy belonging to the service referred to by 'serviceResource' in the dialog. Can also be used to refer to other service policies."
   authorizationAttribute: String
+    @deprecated(
+      reason: "Use of 'authorizationContext' on the service owner API is preferred; this field only reflects the legacy authorization attribute."
+    )
   "Whether the user is authorized to perform the action."
   isAuthorized: Boolean!
   "Indicates whether the action results in the dialog being deleted. Used by frontends to implement custom UX for delete actions."
@@ -649,6 +672,9 @@ type Transmission {
   createdAt: DateTime!
   "Contains an authorization resource attributeId, that can used in custom authorization rules in the XACML service policy, which by default is the policy belonging to the service referred to by 'serviceResource' in the dialog. Can also be used to refer to other service policies. Example: mycustomresource, urn:altinn:subresource:mycustomresource, urn:altinn:task:Task_1, urn:altinn:resource:some-other-service-identifier"
   authorizationAttribute: String
+    @deprecated(
+      reason: "Use of 'authorizationContext' on the service owner API is preferred; this field only reflects the legacy authorization attribute."
+    )
   "Flag indicating if the authenticated user is authorized for this transmission. If not, embedded content and the attachments will not be available."
   isAuthorized: Boolean!
   "Arbitrary URI/URN describing a service-specific transmission type. Refer to the service-specific documentation provided by the service owner for details (if in use)."
@@ -667,8 +693,12 @@ type Transmission {
   content: TransmissionContent!
   "The transmission-level attachments."
   attachments: [Attachment!]!
+  "Attachments on this transmission that exist but are withheld from the authenticated user, listed by id and creation time only. An attachment is excluded rather than shown with masked URLs when its authorization context sets unauthorizedPresentation to 'excluded'. Exclusions are reported per collection: the full set for a dialog is 'excludedAttachments', 'excludedTransmissions', 'excludedGuiActions' and 'excludedApiActions' on the dialog, plus 'excludedAttachments' and 'excludedNavigationalActions' on each transmission. Merge all six when answering 'what changed that I am not allowed to see?'; reading only one under-reports silently."
+  excludedAttachments: [ExcludedElement!]
   "The transmission-level navigational actions."
   navigationalActions: [TransmissionNavigationalAction!]!
+  "Navigational actions on this transmission that exist but are withheld from the authenticated user, listed by id and creation time only. A navigational action is excluded rather than returned with isAuthorized=false when its authorization context sets unauthorizedPresentation to 'excluded'. Exclusions are reported per collection: the full set for a dialog is 'excludedAttachments', 'excludedTransmissions', 'excludedGuiActions' and 'excludedApiActions' on the dialog, plus 'excludedAttachments' and 'excludedNavigationalActions' on each transmission. Merge all six when answering 'what changed that I am not allowed to see?'; reading only one under-reports silently."
+  excludedNavigationalActions: [ExcludedElement!]
 }
 
 type TransmissionContent {
@@ -681,12 +711,16 @@ type TransmissionContent {
 }
 
 type TransmissionNavigationalAction {
+  "The unique identifier for the navigational action in UUIDv7 format."
+  id: UUID!
   "The title of the navigational action."
   title: [Localization!]!
   "The fully qualified URL of the navigational action. Will be set to 'urn:dialogporten:unauthorized' if the user is not authorized to access the transmission, or 'urn:dialogporten:expired' if the action has expired."
   url: URL!
   "The UTC timestamp when the navigational action expires and is no longer available."
   expiresAt: DateTime
+  "Indicates whether the authenticated user is authorized for this navigational action. If not, the URL will be replaced with 'urn:dialogporten:unauthorized'."
+  isAuthorized: Boolean!
 }
 
 interface BulkSetSystemLabelError {