Lisätään sisäinen rajapinta palvelutuottajien suomi.fi-kirjautumiselle

apigw/src/shared/service-client.ts

@@ -65,6 +65,12 @@ export interface EmployeeLoginRequest {
   employeeNumber?: string
 }
 
+export interface EmployeeSuomiFiLoginRequest {
+  ssn: string
+  firstName: string
+  lastName: string
+}
+
 export interface EmployeeUser {
   id: string
   firstName: string
@@ -107,6 +113,19 @@ export async function employeeLogin(
   return data
 }
 
+export async function employeeSuomiFiLogin(
+  employee: EmployeeSuomiFiLoginRequest
+): Promise<EmployeeUser> {
+  const { data } = await client.post<EmployeeUser>(
+    `/system/employee-sfi-login`,
+    employee,
+    {
+      headers: createServiceRequestHeaders(undefined, systemUserHeader)
+    }
+  )
+  return data
+}
+
 export async function getEmployeeDetails(
   req: express.Request,
   employeeId: string

service/src/main/kotlin/fi/espoo/evaka/Audit.kt

@@ -256,6 +256,8 @@ enum class Audit(
     EmployeeDelete(securityEvent = true, securityLevel = "high"),
     EmployeeDeleteDaycareRoles(securityEvent = true, securityLevel = "high"),
     EmployeeLogin(securityEvent = true, securityLevel = "high"),
+    EmployeeSfiLoginAttempt(securityEvent = true, securityLevel = "high"),
+    EmployeeSfiLogin(securityEvent = true, securityLevel = "high"),
     EmployeeRead(securityEvent = true),
     EmployeeUpdateDaycareRoles(securityEvent = true, securityLevel = "high"),
     EmployeeUpdateGlobalRoles(securityEvent = true, securityLevel = "high"),

service/src/main/kotlin/fi/espoo/evaka/pis/EmployeeQueries.kt

@@ -4,6 +4,7 @@
 
 package fi.espoo.evaka.pis
 
+import fi.espoo.evaka.Sensitive
 import fi.espoo.evaka.identity.ExternalId
 import fi.espoo.evaka.pairing.MobileDevice
 import fi.espoo.evaka.pairing.deleteDevice
@@ -123,6 +124,28 @@ RETURNING id, preferred_first_name, first_name, last_name, email, external_id, c
         .exactlyOne<Employee>()
 }
 
+data class EmployeeSuomiFiLoginRequest(
+    val firstName: String,
+    val lastName: String,
+    val ssn: Sensitive<String>,
+)
+
+fun Database.Transaction.loginEmployeeWithSuomiFi(
+    now: HelsinkiDateTime,
+    request: EmployeeSuomiFiLoginRequest,
+): Employee =
+    createUpdate {
+            sql(
+                """
+UPDATE employee
+SET last_login = ${bind(now)}, first_name = ${bind(request.firstName)}, last_name = ${bind(request.lastName)}, active = TRUE
+WHERE social_security_number = ${bind(request.ssn.value)}
+"""
+            )
+        }
+        .executeAndReturnGeneratedKeys()
+        .exactlyOne<Employee>()
+
 fun Database.Read.getEmployeeRoles(id: EmployeeId): EmployeeRoles =
     createQuery {
             sql(

service/src/main/kotlin/fi/espoo/evaka/pis/SystemController.kt

@@ -195,6 +195,48 @@ class SystemController(
             }
     }
 
+    @PostMapping("/system/employee-sfi-login")
+    fun employeeSuomiFiLogin(
+        db: Database,
+        user: AuthenticatedUser.SystemInternalUser,
+        clock: EvakaClock,
+        @RequestBody request: EmployeeSuomiFiLoginRequest,
+    ): EmployeeUser {
+        Audit.EmployeeSfiLoginAttempt.log(
+            targetId = AuditId(request.ssn.value),
+            meta = mapOf("lastName" to request.lastName, "firstName" to request.firstName),
+        )
+        return db.connect { dbc ->
+                dbc.transaction { tx ->
+                    val employee = tx.loginEmployeeWithSuomiFi(clock.now(), request)
+                    val roles = tx.getEmployeeRoles(employee.id)
+                    val employeeUser =
+                        EmployeeUser(
+                            id = employee.id,
+                            firstName = employee.preferredFirstName ?: employee.firstName,
+                            lastName = employee.lastName,
+                            globalRoles = roles.globalRoles,
+                            allScopedRoles = roles.allScopedRoles,
+                            active = employee.active,
+                        )
+                    tx.upsertEmployeeUser(employee.id)
+                    employeeUser
+                }
+            }
+            .also {
+                Audit.EmployeeSfiLogin.log(
+                    targetId = AuditId(request.ssn.value),
+                    objectId = AuditId(it.id),
+                    meta =
+                        mapOf(
+                            "lastName" to request.lastName,
+                            "firstName" to request.firstName,
+                            "globalRoles" to it.globalRoles,
+                        ),
+                )
+            }
+    }
+
     @GetMapping("/system/employee/{id}")
     fun employeeUser(
         db: Database,

service/src/main/resources/db/migration/V472__employee_ssn.sql

@@ -0,0 +1 @@
+ALTER TABLE employee ADD COLUMN social_security_number text CONSTRAINT uniq$employee_ssn UNIQUE;

service/src/main/resources/migrations.txt

@@ -467,3 +467,4 @@ V468__citizen_user.sql
 V469__income_statement_status.sql
 V470__cascade_citizen_user_delete.sql
 V471__application_confidentiality.sql
+V472__employee_ssn.sql