Improve the business-partner-validation extensions

[paullatzelsperger]

WHAT

The current implementation of the BPN validation simply validates a BPN against a hard-coded list of BPNs stored on a policy. While this works well for testing, it is not scalable in a production environment, because

• every contract definition is explicitly bound to specific BPNs
• changing intended recipients of a data offer requires updating the policy
• the same function is bound for Duty, Permission, Prohibition, where it only should be Permission

WHY

Inflexible and actually wrong implementation of BPN validation

HOW

Add a new extension, that performs the validation not against a hard-coded list, but rather reads that list from a database table. This table can be manipulated via a new API endpoint. Thus the following implementation items are necessary:

• In-Mem implementation
• Postgres implementation
• REST controller
• a new Policy evaluation function "BPN in getListFromDatabase()",
• deprecate but don't delete the old extension

[SebastianOpriel]

Some things which come to my mind:

• Deletion of a BPN shall be reflected on consumers side, as the concluded contract couldn't be used anymore and most probably will result in a transfer error.
• A change might be legally a breach of contract, as consumer might rely its business processes on that data
• Wasn't there a discussion around updating contract definitions? I have in min that the proposed solution was to create new contract definitions, assets, etc. Same applied to deleting a concluded contract. But maybe, that is overhauled.

[paullatzelsperger]

Some things which come to my mind:

• Deletion of a BPN shall be reflected on consumers side, as the concluded contract couldn't be used anymore and most probably will result in a transfer error.
• A change might be legally a breach of contract, as consumer might rely its business processes on that data
• Wasn't there a discussion around updating contract definitions? I have in min that the proposed solution was to create new contract definitions, assets, etc. Same applied to deleting a concluded contract. But maybe, that is overhauled.

These are all valid points, but that's not what this issue is about. This issue is about storing the BPNs in a database, instead of hard-coding them directly in the policy. So functionally, nothing will change.

Updating ContractDefinitions is possible via the Management API

Whether or not a particular operation is allowed from a legal perspective may vary with country, jurisdiction, business context, etc., so it must be handled elsewhere, i.e. outside of EDC.

[SebastianOpriel]

Thanks for clarification and hint to Mgt API!