bugfix: ensure to mask SSN numbers (#1822)

bugfix: ensure to mask SSN

Author: framitdavid

src/Altinn.App.Api/Controllers/AuthorizationController.cs

@@ -1,4 +1,5 @@
 using System.Globalization;
+using Altinn.App.Api.Helpers;
 using Altinn.App.Core.Configuration;
 using Altinn.App.Core.Features.Auth;
 using Altinn.App.Core.Internal.Auth;
@@ -58,7 +59,7 @@ public async Task GetCurrentParty(bool returnPartyObject = false)
                 {
                     if (returnPartyObject)
                     {
-                        return Ok(details.SelectedParty);
+                        return Ok(PartySsnMasking.MaskParty(details.SelectedParty));
                     }
 
                     return Ok(details.SelectedParty.PartyId);
@@ -79,7 +80,7 @@ public async Task GetCurrentParty(bool returnPartyObject = false)
 
                 if (returnPartyObject)
                 {
-                    return Ok(reportee);
+                    return Ok(PartySsnMasking.MaskParty(reportee));
                 }
                 return Ok(reportee.PartyId);
             }
@@ -88,7 +89,7 @@ public async Task GetCurrentParty(bool returnPartyObject = false)
                 var details = await org.LoadDetails();
                 if (returnPartyObject)
                 {
-                    return Ok(details.Party);
+                    return Ok(PartySsnMasking.MaskParty(details.Party));
                 }
 
                 return Ok(details.Party.PartyId);
@@ -98,7 +99,7 @@ public async Task GetCurrentParty(bool returnPartyObject = false)
                 var details = await so.LoadDetails();
                 if (returnPartyObject)
                 {
-                    return Ok(details.Party);
+                    return Ok(PartySsnMasking.MaskParty(details.Party));
                 }
 
                 return Ok(details.Party.PartyId);
@@ -108,7 +109,7 @@ public async Task GetCurrentParty(bool returnPartyObject = false)
                 var details = await su.LoadDetails();
                 if (returnPartyObject)
                 {
-                    return Ok(details.Party);
+                    return Ok(PartySsnMasking.MaskParty(details.Party));
                 }
 
                 return Ok(details.Party.PartyId);

src/Altinn.App.Api/Controllers/PartiesController.cs

@@ -1,4 +1,5 @@
 using System.Globalization;
+using Altinn.App.Api.Helpers;
 using Altinn.App.Core.Configuration;
 using Altinn.App.Core.Features.Auth;
 using Altinn.App.Core.Models.Validation;
@@ -49,25 +50,23 @@ public async Task Get(string org, string app, bool allowedToInsta
             case Authenticated.User user:
             {
                 var details = await user.LoadDetails(validateSelectedParty: false);
-                return allowedToInstantiateFilter ? Ok(details.PartiesAllowedToInstantiate) : Ok(details.Parties);
+                var parties = allowedToInstantiateFilter ? details.PartiesAllowedToInstantiate : details.Parties;
+                return Ok(PartySsnMasking.MaskParties(parties));
             }
             case Authenticated.Org orgInfo:
             {
                 var details = await orgInfo.LoadDetails();
-                IReadOnlyList<Party> parties = [details.Party];
-                return Ok(parties);
+                return Ok(PartySsnMasking.MaskParties([details.Party]));
             }
             case Authenticated.ServiceOwner serviceOwner:
             {
                 var details = await serviceOwner.LoadDetails();
-                IReadOnlyList<Party> parties = [details.Party];
-                return Ok(parties);
+                return Ok(PartySsnMasking.MaskParties([details.Party]));
             }
             case Authenticated.SystemUser su:
             {
                 var details = await su.LoadDetails();
-                IReadOnlyList<Party> parties = [details.Party];
-                return Ok(parties);
+                return Ok(PartySsnMasking.MaskParties([details.Party]));
             }
             default:
                 throw new Exception($"Unexpected authentication context: {context.GetType().Name}");
@@ -102,7 +101,7 @@ public async Task ValidateInstantiation(string org, string app, [
                         {
                             Valid = false,
                             Message = "The user does not represent the supplied party",
-                            ValidParties = details.PartiesAllowedToInstantiate.ToList(),
+                            ValidParties = PartySsnMasking.MaskParties(details.PartiesAllowedToInstantiate),
                         }
                     );
                 }
@@ -114,7 +113,7 @@ public async Task ValidateInstantiation(string org, string app, [
                         {
                             Valid = false,
                             Message = "The supplied party is not allowed to instantiate the application",
-                            ValidParties = details.PartiesAllowedToInstantiate.ToList(),
+                            ValidParties = PartySsnMasking.MaskParties(details.PartiesAllowedToInstantiate),
                         }
                     );
                 }
@@ -131,7 +130,7 @@ public async Task ValidateInstantiation(string org, string app, [
                         {
                             Valid = false,
                             Message = "The user does not represent the supplied party",
-                            ValidParties = new List<Party> { details.Party },
+                            ValidParties = PartySsnMasking.MaskParties([details.Party]),
                         }
                     );
                 }
@@ -142,7 +141,7 @@ public async Task ValidateInstantiation(string org, string app, [
                         {
                             Valid = false,
                             Message = "The supplied party is not allowed to instantiate the application",
-                            ValidParties = new List<Party> { details.Party },
+                            ValidParties = PartySsnMasking.MaskParties([details.Party]),
                         }
                     );
                 }
@@ -163,7 +162,7 @@ public async Task ValidateInstantiation(string org, string app, [
                         {
                             Valid = false,
                             Message = "The user does not represent the supplied party",
-                            ValidParties = new List<Party> { details.Party },
+                            ValidParties = PartySsnMasking.MaskParties([details.Party]),
                         }
                     );
                 }
@@ -174,7 +173,7 @@ public async Task ValidateInstantiation(string org, string app, [
                         {
                             Valid = false,
                             Message = "The supplied party is not allowed to instantiate the application",
-                            ValidParties = new List<Party> { details.Party },
+                            ValidParties = PartySsnMasking.MaskParties([details.Party]),
                         }
                     );
                 }

src/Altinn.App.Api/Controllers/ProfileController.cs

@@ -1,3 +1,4 @@
+using Altinn.App.Api.Helpers;
 using Altinn.App.Core.Features.Auth;
 using Altinn.Platform.Profile.Models;
 using Microsoft.AspNetCore.Authorization;
@@ -38,7 +39,7 @@ public async Task GetUser()
             case Authenticated.User user:
             {
                 var details = await user.LoadDetails(validateSelectedParty: false);
-                return Ok(details.Profile);
+                return Ok(PartySsnMasking.MaskUserProfile(details.Profile));
             }
             default:
                 return BadRequest($"Unknown authentication context: {context.GetType().Name}");

src/Altinn.App.Api/Helpers/PartySsnMasking.cs

@@ -0,0 +1,129 @@
+using System.Diagnostics.CodeAnalysis;
+using System.Reflection;
+using Altinn.App.Core.Extensions;
+using Altinn.Platform.Profile.Models;
+using Altinn.Platform.Register.Models;
+
+namespace Altinn.App.Api.Helpers;
+
+/// 
+/// Produces copies of  objects with their social security numbers (SSNs) masked,
+/// so the full SSN is never leaked in HTTP responses (e.g. "12345678901" becomes "123456*****").
+/// The masking rule itself lives in ; this type only
+/// applies it across the party graph. The original objects (which may be cached and used server-side)
+/// are never modified.
+/// 
+internal static class PartySsnMasking
+{
+    // The properties we copy when cloning. Cached once per type so we don't reflect on every call.
+    private static readonly PropertyInfo[] _partyProperties = CopyableProperties(typeof(Party));
+    private static readonly PropertyInfo[] _personProperties = CopyableProperties(typeof(Person));
+    private static readonly PropertyInfo[] _userProfileProperties = CopyableProperties(typeof(UserProfile));
+
+    /// 
+    /// Returns a copy of  with the SSN masked on its nested
+    ///  (including that party's  and
+    /// ). Returns null if  is null.
+    /// 
+    [return: NotNullIfNotNull(nameof(profile))]
+    public static UserProfile? MaskUserProfile(UserProfile? profile)
+    {
+        if (profile is null)
+        {
+            return null;
+        }
+
+        UserProfile clone = new UserProfile();
+        CopyProperties(_userProfileProperties, profile, clone);
+
+        clone.Party = MaskParty(profile.Party);
+
+        return clone;
+    }
+
+    /// 
+    /// Returns a new list where every party is a masked copy of the corresponding input party.
+    /// 
+    public static List<Party> MaskParties(IEnumerable<Party> parties)
+    {
+        List<Party> maskedParties = new List<Party>();
+        foreach (Party party in parties)
+        {
+            maskedParties.Add(MaskParty(party));
+        }
+
+        return maskedParties;
+    }
+
+    /// 
+    /// Returns a copy of  with the SSN masked, including the nested
+    ///  and any . Returns null if
+    ///  is null.
+    /// 
+    [return: NotNullIfNotNull(nameof(party))]
+    public static Party? MaskParty(Party? party)
+    {
+        if (party is null)
+        {
+            return null;
+        }
+
+        // Copy every field as-is, then transform only the parts that carry an SSN.
+        Party clone = new Party();
+        CopyProperties(_partyProperties, party, clone);
+
+        clone.SSN = NationalIdentityNumberExtensions.Mask(party.SSN);
+        clone.Person = MaskPerson(party.Person);
+        clone.ChildParties = MaskChildParties(party.ChildParties);
+
+        return clone;
+    }
+
+    private static List<Party>? MaskChildParties(List<Party>? childParties)
+    {
+        if (childParties is null)
+        {
+            return null;
+        }
+
+        return MaskParties(childParties);
+    }
+
+    /// 
+    /// Returns a copy of  with only the SSN masked; all other fields are
+    /// copied as-is. Returns null if  is null.
+    /// 
+    private static Person? MaskPerson(Person? person)
+    {
+        if (person is null)
+        {
+            return null;
+        }
+
+        Person clone = new Person();
+        CopyProperties(_personProperties, person, clone);
+
+        clone.SSN = NationalIdentityNumberExtensions.Mask(person.SSN);
+
+        return clone;
+    }
+
+    /// 
+    /// Returns the readable and writable, non-indexer properties of ;
+    /// these are the ones we can copy when cloning.
+    /// 
+    private static PropertyInfo[] CopyableProperties(Type type)
+    {
+        return type.GetProperties()
+            .Where(property => property.CanRead && property.CanWrite && property.GetIndexParameters().Length == 0)
+            .ToArray();
+    }
+
+    private static void CopyProperties(PropertyInfo[] properties, object source, object destination)
+    {
+        foreach (PropertyInfo property in properties)
+        {
+            property.SetValue(destination, property.GetValue(source));
+        }
+    }
+}

src/Altinn.App.Core/Extensions/NationalIdentityNumberExtensions.cs

@@ -5,6 +5,11 @@ namespace Altinn.App.Core.Extensions;
 
 internal static class NationalIdentityNumberExtensions
 {
+    /// 
+    /// Number of leading characters (the DDMMYY birth date) kept visible when masking; the rest is replaced with '*'.
+    /// 
+    private const int VisibleDigits = 6;
+
     /// 
     /// Returns a string representation of the , prefixed with the  URN value
     /// 
@@ -20,4 +25,38 @@ public static string ToUrnFormattedString(this NationalIdentityNumber identityNu
     {
         return identityNumber is null ? null : $"{AltinnUrns.PersonId}:{identityNumber}";
     }
+
+    /// 
+    /// Returns the national identity number with all but the first  characters
+    /// (the DDMMYY birth date) replaced with '*', e.g. "12345678901" becomes "123456*****".
+    /// 
+    public static string ToMaskedString(this NationalIdentityNumber identityNumber)
+    {
+        return Mask(identityNumber.Value) ?? string.Empty;
+    }
+
+    /// 
+    /// Masks a national identity number string: keeps the first  characters
+    /// (the DDMMYY birth date) visible and replaces the rest with '*', e.g. "12345678901" becomes "123456*****".
+    /// This is a defensive helper for not leaking SSNs: it deliberately does NOT validate the input, so a
+    /// partial or malformed value is still masked rather than returned in the clear. Validating first would
+    /// risk leaking any value that fails the check. null and empty values are returned unchanged.
+    /// 
+    public static string? Mask(string? nationalIdentityNumber)
+    {
+        if (string.IsNullOrEmpty(nationalIdentityNumber))
+        {
+            return nationalIdentityNumber;
+        }
+
+        if (nationalIdentityNumber.Length <= VisibleDigits)
+        {
+            // Too short to keep any part visible, so mask the whole thing.
+            return new string('*', nationalIdentityNumber.Length);
+        }
+
+        string visiblePart = nationalIdentityNumber.Substring(0, VisibleDigits);
+        string maskedPart = new string('*', nationalIdentityNumber.Length - VisibleDigits);
+        return visiblePart + maskedPart;
+    }
 }

test/Altinn.App.Api.Tests/Controllers/ProfileControllerTests.User.verified.txt

@@ -86,7 +86,7 @@
           partyUuid: null,
           partyTypeName: 0,
           orgNumber: null,
-          ssn: 01039012345,
+          ssn: 010390*****,
           unitType: null,
           name: null,
           isDeleted: false,