Skip to content

Incorrect requestedBy in SubscriptionRequest is set to subscriber IRI instead of requestor IRI

Description:
When a subscription request is initiated the api#requestedBy property is currently set to subscriber.iri() from Subscription object. This can be observed in the following code snippet:

var request = new SubscriptionRequest(requestIri, RequestStatus.REQUEST_PENDING, Instant.now(),
                subscription.subscriber(), Optional.empty(), Optional.empty(),
                Optional.empty(), subscription);

For reference, see the relevant code here.

Proposed Solution:
Similar to the ChangeRequest and AccessDelegationRequest, the logisticsAgentUri from the JWT token should be used instead of subscriber.iri(). To implement this, retrieve the URI using accessSubject.iri() from the InternalAccessSubject class:

org.openlogisticsfoundation.neone.security.InternalAccessSubject accessSubject;

By doing so, the subscription request will correctly reflect the agent making the request according to the JWT token, rather than defaulting to the subscriber.