fix: return after context.Fail() in StorageAccessHandler

[LindqvistMartin]

Description

On a PDP deny HandleRequirementAsync calls context.Fail() and then falls
through to context.Succeed(requirement). Fail() already forces the denial, so
this changes nothing today, but the trailing Succeed() is dead code. Add a
return after Fail() so it stops on deny, like the missing-instanceGuid branch
above already does.

Added a unit test asserting the requirement stays in context.PendingRequirements
on deny — the one thing the stray Succeed() changes.

Related Issue(s)

• Bug: missing return after context fail in StorageAccessHandler altinn-studio#19348

Verification

• Your code builds clean without any errors or warnings
• Manual testing done (required)
• Relevant automated test added (if you find this hard, leave it and we'll help out)
• All tests run green

Documentation

• User documentation is updated with a separate linked PR in altinn-studio-docs. (if applicable)

Summary by CodeRabbit

• Bug Fixes

  • Fixed an authorization flow issue so a denied decision now correctly stops processing and cannot accidentally be treated as allowed.
  • Improved handling of failed access checks to keep denied requests from succeeding.

• Tests

  • Added coverage for the denial path to verify failed authorization stays pending and is marked as failed.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 84f092ba-9d34-45bc-a31e-5df14151dbda

📥 Commits

Reviewing files that changed from the base of the PR and between bd058ad and 42ad8e6.

📒 Files selected for processing (2)

• src/Storage/Authorization/StorageAccessHandler.cs
• test/UnitTest/TestingHandlers/StorageAccessHandlerTests.cs

---

📝 Walkthrough

Walkthrough

Modifies StorageAccessHandler to return immediately after calling context.Fail() when a PDP decision is invalid, preventing fall-through to the success path. Adds a corresponding unit test verifying the requirement remains pending when PDP denies access.

Changes

StorageAccessHandler PDP Deny Fix

Layer / File(s)	Summary
Fix control flow on PDP deny src/Storage/Authorization/StorageAccessHandler.cs	Adds an immediate return after context.Fail() in the invalid-decision branch of HandleRequirementAsync, preventing fall-through to context.Succeed(requirement).
Unit test for deny scenario test/UnitTest/TestingHandlers/StorageAccessHandlerTests.cs	Adds StorageAccessHandlerTests with a test that mocks dependencies, simulates a PDP Deny decision, and asserts the context fails while the requirement remains pending.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Related Issues: None specified.

Suggested labels: bug, tests

Suggested reviewers: None specified.

Poem

A rabbit hopped through code so tight,
Found a Fail() that lost its bite,
Added "return" to seal the gate,
No more Succeed when Deny's the fate,
Now tests confirm it's all just right! 🐰

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main fix in StorageAccessHandler: returning immediately after context.Fail().
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}