fix(DeliveryRequestApiService): filter deliveries requested by partner role and incoterms

[tom-rm-meyer-ISST]

Description

resolves #432

Maybe we need also to do similar enhancements to the following fields

• DeliveryService / OwnDeliveryService
• Frontend > incoterm and partner relationship including current role in dashboard (not sure, if we already have it but I think there is something in place)

Please let me know what you think. Based on the changes I would release a patch version

Pre-review checks

Please ensure to do as many of the following checks as possible, before asking for committer review:

• DEPENDENCIES are up-to-date. Dash license tool. Committers can open IP issues for restricted libs.
• Copyright and license header are present on all affected files

[ReneSchroederLJ]

Thank you for your contribution.

Overall solid work, but besides a comment I left on a bug there seems to be an issue with how the material is retrieved in handleDeliverySubmodelRequest. There is a disconnect between the comment and what is actually happening.

At first we attempt to find the material by assuming that we are supplier and the Cx number is our own. If this fails we should check if we are customer and the Cx number matches the partnerCxNumber in any mpr for that partner. only if that fails we should triggerPartTypeRetrieval and afterwards check the mpr again.

Currently we do not check the mpr at all so we can not handle requests where we are the customer.

[tom-rm-meyer-ISST]

Thank you for your contribution.

Overall solid work, but besides a comment I left on a bug there seems to be an issue with how the material is retrieved in handleDeliverySubmodelRequest. There is a disconnect between the comment and what is actually happening.

At first we attempt to find the material by assuming that we are supplier and the Cx number is our own. If this fails we should check if we are customer and the Cx number matches the partnerCxNumber in any mpr for that partner. only if that fails we should triggerPartTypeRetrieval and afterwards check the mpr again.

Currently we do not check the mpr at all so we can not handle requests where we are the customer.

Well seen! While implementing the change and a test to get this scenario tested, I recognized that this might even be unwanted behavior: If we don't have the CX ID when being customer, this means we did not create a Shell Descriptor with a href. Someone tries to access data directly via the asset / interface without the DTR to see how to access the data.

I added a warning message as I think this could be a security issue, if a partner tries to do that.

[ReneSchroederLJ]

Looks good to me. Thank you for your efforts.

[tom-rm-meyer-ISST]

Bumped version to create a patch release