Add entriesAdditions and allowedImportAdditions for policy imports

[thjaeckle]

Resolves: #2221

Introduce entriesAdditions on policy imports to allow importing policies to additively merge subjects and resources into imported policy entries. Template policies control what can be extended via allowedImportAdditions (enum-backed, secure-by-default: empty set means no additions allowed).

New model types: EntryAddition, EntriesAdditions, AllowedImportAddition enum. Write-time validation ensures entriesAdditions labels are declared in entries. Merge-time logic in PolicyImporter silently skips disallowed additions.

The PR also adds HTTP endpoints for:

• /api/2/policies/{policyId}/entries/{label}/allowedImportAdditions
• /api/2/policies/{policyId}/entries/{label}/importable (was existing before in the policy model, however no extra endpoint was yet provided)
• /api/2/policies/{policyId}/imports/{importedPolicyId}/entries (was existing before in the policy model, however no extra endpoint was yet provided)
• /api/2/policies/{policyId}/imports/{importedPolicyId}/entriesAdditions

As adding those separate endpoints and providing also model classes to map requests/responses adds a lot of boilerplate code, the PR got quite big..

[thjaeckle]

System tests run: https://github.com/eclipse-ditto/ditto/actions/runs/22302981477

Inlcuding added tests from eclipse-ditto/ditto-testing#22

[alstanchev]

Other than the one comment looks great 👍

[hu-ahmed]

I noticed an issue in the importable API validation.

PUT /api/2/policies/{id}/entries/{label}/importable returns 500 for invalid payload values, but this should be a 400 Bad Request validation error.

Repro:

control case (valid -> 204)

curl -g -sS -i -X PUT
-H "Authorization: Bearer $TOKEN"
-H 'Content-Type: application/json'
--data '"never"'
'http://127.0.0.1:8080/api/2/policies/org.eclipse.pr2347%3Aimported-retest/entries/template/importable'

failing case (invalid -> currently 500, should be 400)

curl -g -sS -i -X PUT
-H "Authorization: Bearer $TOKEN"
-H 'Content-Type: application/json'
--data '"bogus"'
'http://127.0.0.1:8080/api/2/policies/org.eclipse.pr2347%3Aimported-retest/entries/template/importable'

[hu-ahmed]

I noticed another issue in allowedImportAdditions validation.

PUT /api/2/policies/{id}/entries/{label}/allowedImportAdditions accepts invalid enum values silently, but it should return a 400 Bad Request validation error.

Repro:

control case (valid -> 204)

curl -g -sS -i -X PUT
-H "Authorization: Bearer $TOKEN"
-H 'Content-Type: application/json'
--data '["subjects"]'
'http://127.0.0.1:8080/api/2/policies/org.eclipse.pr2347%3Arepro-allowed-additions/entries/template/allowedImportAdditions'

failing case (invalid -> currently 204, should be 400)

curl -g -sS -i -X PUT
-H "Authorization: Bearer $TOKEN"
-H 'Content-Type: application/json'
--data '["subjects","bogus"]'
'http://127.0.0.1:8080/api/2/policies/org.eclipse.pr2347%3Arepro-allowed-additions/entries/template/allowedImportAdditions'
verify stored value after invalid PUT
curl -g -sS -i
-H "Authorization: Bearer $TOKEN"
'http://127.0.0.1:8080/api/2/policies/org.eclipse.pr2347%3Arepro-allowed-additions/entries/template/allowedImportAdditions'

[thjaeckle]

Thanks @hu-ahmed for catching both issues! 👍

Fixed in b6b48b9:

• PUT .../importable with invalid values now returns 400 instead of 500
• PUT .../allowedImportAdditions with invalid enum values now returns 400 instead of silently dropping them

Also added regression tests for both cases.