Incorrect requestedBy in SubscriptionRequest is set to subscriber IRI instead of requestor IRI
Description:
When a subscription request is initiated the api#requestedBy
property is currently set to subscriber.iri()
from Subscription
object. This can be observed in the following code snippet:
var request = new SubscriptionRequest(requestIri, RequestStatus.REQUEST_PENDING, Instant.now(),
subscription.subscriber(), Optional.empty(), Optional.empty(),
Optional.empty(), subscription);
For reference, see the relevant code here.
Proposed Solution:
Similar to the ChangeRequest
and AccessDelegationRequest
, the logisticsAgentUri
from the JWT token should be used instead of subscriber.iri()
. To implement this, retrieve the URI using accessSubject.iri()
from the InternalAccessSubject
class:
org.openlogisticsfoundation.neone.security.InternalAccessSubject accessSubject;
By doing so, the subscription request will correctly reflect the agent making the request according to the JWT token, rather than defaulting to the subscriber.