Introduce Device Policy API

[kaviska]

Purpose

This PR introduces a new Device Policy REST API (/api/server/v1/device-policies) to the Identity Server API Server layer. It exposes device policy rule field metadata over HTTP so that the console rule builder can be populated with the fields applicable to a given device platform. Rule field metadata for the devicePolicy flow is served by the flow-agnostic RuleMetadataService, while platform applicability is device domain knowledge owned by carbon-identity-framework; this component composes the two so that rule-mgt never has to learn about device platforms.

Goals

Expose platform-aware device policy field metadata through a versioned (v1) REST API:

• Return the rule fields applicable to the devicePolicy flow.
• Filter those fields to a single platform (android, ios, macos, windows) so that platform-irrelevant fields are not offered to the user.
• Treat fields with no declared platform restriction as universal, applicable to every platform.
• Reject unsupported platform values with 400 rather than silently returning a partial list.

Approach

A new Maven component org.wso2.carbon.identity.api.server.device.policy is added with two modules, following the established API-server conventions:

• .common – shared Constants (error codes with the DPM- prefix) and DevicePolicyMetadataServiceHolder, which resolves the RuleMetadataService and DeviceFieldMetadataService OSGi services from the Carbon context.
• .v1 – the versioned API:
  • device-policy.yaml – the OpenAPI 3.0 contract; the src/gen interfaces and models are generated from it.
  • DevicePoliciesApiServiceImpl – JAX-RS delegate; maps the core service result to a 200 response.
  • DevicePolicyMetadataService (core) – resolves the tenant domain from context, retrieves the DEVICE_POLICY field definitions from RuleMetadataService, applies the platform filter, and translates the framework models into the API models.
  • DevicePolicyMetadataServiceFactory – constructor-injects both OSGi services into the core service once at startup, failing fast if either is unavailable.
  • DevicePolicyAPIErrorBuilder – centralizes error construction, mapping request validation failures to 400 and metadata retrieval failures to 500.

The component is registered in the reactor and in dependencyManagement in the root pom.xml; no existing module is modified. The endpoint is guarded by the internal_device_policy_view scope.

User stories

• As a tenant admin configuring a device policy for Android, I want to see only the rule fields that are meaningful on Android so that I do not build a rule that can never be satisfied.
• As a tenant admin, I want fields that apply to every platform to always be offered, regardless of which platform I am configuring.
• As an API client, I want an unsupported platform value to be rejected explicitly so that a typo does not silently produce an incomplete field list.

Developer Checklist (Mandatory)

• Complete the Developer Checklist in the related product-is issue to track any behavioral change or migration impact.

Release note

N/A

Documentation

N/A

Training

N/A

Certification

N/A

Marketing

N/A

Automation tests

N/A

Security checks

• Followed secure coding standards in http://wso2.com/technical-reports/wso2-secure-engineering-guidelines? yes
• Ran FindSecurityBugs plugin and verified report?
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets? yes

Samples

N/A

Related PRs

This PR depends on the new org.wso2.carbon.identity.device.policy component in carbon-identity-framework, which is not yet published to the WSO2 Maven repository.

Migrations (if applicable)

N/A – new API, no migration required.

Test environment

N/A

Learning

N/A

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: f2ea792f-1aea-4bae-8d29-bac00d7875b6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}