Skip to content

Commit a5e2b31

Browse files
TomdangoTomdango
authored
Merge pull request #557 from NHSDigital/feature/thju1-NRL-578-implementValidationFramework
NRL-578 Integration tests
2 parents 8939a44 + c3b4190 commit a5e2b31

21 files changed

+1604
-548
lines changed

‎api/producer/createDocumentReference/create_document_reference.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -58,8 +58,8 @@ def handler(
5858

5959
logger.log(LogReference.PROCREATE001, resource=body)
6060

61-
ods_prefix = metadata.ods_code_parts[0]
62-
body.id = f"{ods_prefix}-{uuid4()}"
61+
id_prefix = "|".join(metadata.ods_code_parts)
62+
body.id = f"{id_prefix}-{uuid4()}"
6363

6464
validator = DocumentReferenceValidator()
6565
result = validator.validate(body)

‎api/producer/searchDocumentReference/search_document_reference.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,12 +30,12 @@ def handler(
3030

3131
logger.log(LogReference.PROSEARCH000)
3232

33-
if not params.nhs_number:
33+
if params.subject_identifier and not params.nhs_number:
3434
logger.log(
3535
LogReference.PROSEARCH001, subject_identifier=params.subject_identifier
3636
)
3737
return SpineErrorResponse.INVALID_NHS_NUMBER(
38-
diagnostics="A valid NHS number is required to search for document references",
38+
diagnostics="Invalid NHS number provided in the search parameters",
3939
expression="subject:identifier",
4040
)
4141

‎api/producer/searchDocumentReference/tests/test_search_document_reference_producer.py‎

Lines changed: 6 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -75,28 +75,14 @@ def test_search_document_reference_missing_nhs_number(
7575
result = handler(event, create_mock_context())
7676
body = result.pop("body")
7777

78-
assert result == {"statusCode": "400", "headers": {}, "isBase64Encoded": False}
78+
assert result == {"statusCode": "200", "headers": {}, "isBase64Encoded": False}
7979

8080
parsed_body = json.loads(body)
8181
assert parsed_body == {
82-
"resourceType": "OperationOutcome",
83-
"issue": [
84-
{
85-
"severity": "error",
86-
"code": "invalid",
87-
"details": {
88-
"coding": [
89-
{
90-
"code": "INVALID_NHS_NUMBER",
91-
"display": "Invalid NHS number",
92-
"system": "https://fhir.nhs.uk/ValueSet/Spine-ErrorOrWarningCode-1",
93-
}
94-
]
95-
},
96-
"diagnostics": "A valid NHS number is required to search for document references",
97-
"expression": ["subject:identifier"],
98-
}
99-
],
82+
"resourceType": "Bundle",
83+
"type": "searchset",
84+
"total": 0,
85+
"entry": [],
10086
}
10187

10288

@@ -133,7 +119,7 @@ def test_search_document_reference_invalid_nhs_number(
133119
}
134120
]
135121
},
136-
"diagnostics": "A valid NHS number is required to search for document references",
122+
"diagnostics": "Invalid NHS number provided in the search parameters",
137123
"expression": ["subject:identifier"],
138124
}
139125
],

‎tests/features/consumer/countDocumentReference-failure.feature‎

Lines changed: 13 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,14 @@ Feature: Consumer - countDocumentReference - Failure Scenarios
22

33
Scenario: No query parameters provided
44
Given the application 'DataShare' (ID 'z00z-y11y-x22x') is registered to access the API
5-
And the organisation 'Yorkshire Ambulance Service' (ODS Code 'RX898') is authorised to access pointer types:
5+
And the organisation 'RX898' is authorised to access pointer types:
66
| system | value |
77
| http://snomed.info/sct | 736253002 |
8-
When the organisation 'RX898' requests to count DocumentReferences with parameters:
8+
When consumer 'RX898' counts DocumentReferences with parameters:
99
| parameter | value |
1010
Then the response status code is 400
1111
And the response is an OperationOutcome with 1 issue
12-
And the OperationOutcome contains the following issue:
12+
And the OperationOutcome contains the issue:
1313
"""
1414
{
1515
"severity": "error",
@@ -28,15 +28,15 @@ Feature: Consumer - countDocumentReference - Failure Scenarios
2828

2929
Scenario: Invalid NHS number provided
3030
Given the application 'DataShare' (ID 'z00z-y11y-x22x') is registered to access the API
31-
And the organisation 'Yorkshire Ambulance Service' (ODS Code 'RX898') is authorised to access pointer types:
31+
And the organisation 'RX898' is authorised to access pointer types:
3232
| system | value |
3333
| http://snomed.info/sct | 736253002 |
34-
When the organisation 'RX898' requests to count DocumentReferences with parameters:
34+
When consumer 'RX898' counts DocumentReferences with parameters:
3535
| parameter | value |
3636
| subject:identifier | https://fhir.nhs.uk/Id/nhs-number\|123 |
3737
Then the response status code is 400
3838
And the response is an OperationOutcome with 1 issue
39-
And the OperationOutcome contains the following issue:
39+
And the OperationOutcome contains the issue:
4040
"""
4141
{
4242
"severity": "error",
@@ -55,14 +55,14 @@ Feature: Consumer - countDocumentReference - Failure Scenarios
5555

5656
Scenario: Organisation has no permissions
5757
Given the application 'DataShare' (ID 'z00z-y11y-x22x') is registered to access the API
58-
And the organisation 'Yorkshire Ambulance Service' (ODS Code 'RX898') is authorised to access pointer types:
58+
And the organisation 'RX898' is authorised to access pointer types:
5959
| system | value |
60-
When the organisation 'RX898' requests to count DocumentReferences with parameters:
60+
When consumer 'RX898' counts DocumentReferences with parameters:
6161
| parameter | value |
6262
| subject:identifier | https://fhir.nhs.uk/Id/nhs-number\|999999999 |
6363
Then the response status code is 403
6464
And the response is an OperationOutcome with 1 issue
65-
And the OperationOutcome contains the following issue:
65+
And the OperationOutcome contains the issue:
6666
"""
6767
{
6868
"severity": "error",
@@ -81,12 +81,14 @@ Feature: Consumer - countDocumentReference - Failure Scenarios
8181
Scenario: Organisation has no permissions in S3
8282
Given the application 'DataShare' (ID 'z00z-y11y-x22x') is registered to access the API
8383
And the application is configured to lookup permissions from S3
84-
When the organisation 'RX898' requests to count DocumentReferences with parameters:
84+
And the organisation 'RX898' is authorised in S3 to access pointer types
85+
| system | value |
86+
When consumer 'RX898' counts DocumentReferences with parameters:
8587
| parameter | value |
8688
| subject:identifier | https://fhir.nhs.uk/Id/nhs-number\|999999999 |
8789
Then the response status code is 403
8890
And the response is an OperationOutcome with 1 issue
89-
And the OperationOutcome contains the following issue:
91+
And the OperationOutcome contains the issue:
9092
"""
9193
{
9294
"severity": "error",

‎tests/features/consumer/countDocumentReference-success.feature‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ Feature: Consumer - countDocumentReference - Success Scenarios
22

33
Scenario: Single pointer found for patient
44
Given the application 'DataShare' (ID 'z00z-y11y-x22x') is registered to access the API
5-
And the organisation 'Yorkshire Ambulance Service' (ODS Code 'RX898') is authorised to access pointer types:
5+
And the organisation 'RX898' is authorised to access pointer types:
66
| system | value |
77
| http://snomed.info/sct | 736253002 |
88
And a DocumentReference resource exists with values:
@@ -14,16 +14,17 @@ Feature: Consumer - countDocumentReference - Success Scenarios
1414
| contentType | application/pdf |
1515
| url | https://example.org/my-doc.pdf |
1616
| custodian | 8FW23 |
17-
When the organisation 'RX898' requests to count DocumentReferences with parameters:
17+
When consumer 'RX898' counts DocumentReferences with parameters:
1818
| parameter | value |
1919
| subject:identifier | https://fhir.nhs.uk/Id/nhs-number\|9278693472 |
2020
Then the response status code is 200
21-
And the response is a searchset Bundle with a total of 1
21+
And the response is a searchset Bundle
22+
And the Bundle has a total of 1
2223
And the response does not contain the key 'entry'
2324

2425
Scenario: No pointers found for patient
2526
Given the application 'DataShare' (ID 'z00z-y11y-x22x') is registered to access the API
26-
And the organisation 'Yorkshire Ambulance Service' (ODS Code 'RX898') is authorised to access pointer types:
27+
And the organisation 'RX898' is authorised to access pointer types:
2728
| system | value |
2829
| http://snomed.info/sct | 736253002 |
2930
And a DocumentReference resource exists with values:
@@ -35,16 +36,17 @@ Feature: Consumer - countDocumentReference - Success Scenarios
3536
| contentType | application/pdf |
3637
| url | https://example.org/my-doc.pdf |
3738
| custodian | 8FW23 |
38-
When the organisation 'RX898' requests to count DocumentReferences with parameters:
39+
When consumer 'RX898' counts DocumentReferences with parameters:
3940
| parameter | value |
4041
| subject:identifier | https://fhir.nhs.uk/Id/nhs-number\|9995001624 |
4142
Then the response status code is 200
42-
And the response is a searchset Bundle with a total of 0
43+
And the response is a searchset Bundle
44+
And the Bundle has a total of 0
4345
And the response does not contain the key 'entry'
4446

4547
Scenario: Multiple pointers found for patient
4648
Given the application 'DataShare' (ID 'z00z-y11y-x22x') is registered to access the API
47-
And the organisation 'Yorkshire Ambulance Service' (ODS Code 'RX898') is authorised to access pointer types:
49+
And the organisation 'RX898' is authorised to access pointer types:
4850
| system | value |
4951
| http://snomed.info/sct | 736253002 |
5052
| http://snomed.info/sct | 887701000000100 |
@@ -75,9 +77,10 @@ Feature: Consumer - countDocumentReference - Success Scenarios
7577
| contentType | application/pdf |
7678
| url | https://example.org/my-doc3.pdf |
7779
| custodian | 8FW23 |
78-
When the organisation 'RX898' requests to count DocumentReferences with parameters:
80+
When consumer 'RX898' counts DocumentReferences with parameters:
7981
| parameter | value |
8082
| subject:identifier | https://fhir.nhs.uk/Id/nhs-number\|9278693472 |
8183
Then the response status code is 200
82-
And the response is a searchset Bundle with a total of 3
84+
And the response is a searchset Bundle
85+
And the Bundle has a total of 3
8386
And the response does not contain the key 'entry'

‎tests/features/consumer/readDocumentReference-failure.feature‎

Lines changed: 176 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,177 @@
1-
# No path params provided or no ID in params
2-
# No permissions to access resource in request params
3-
# No permissions to access resource in S3 bucket
4-
# Attempt to access pointer type without permissions
51
# Invalid ID (X26|Something-)
2+
Feature: Consumer - readDocumentReference - Failure Scenarios
3+
4+
Scenario: Pointer not found
5+
Given the application 'DataShare' (ID 'z00z-y11y-x22x') is registered to access the API
6+
And the organisation 'RX898' is authorised to access pointer types:
7+
| system | value |
8+
| http://snomed.info/sct | 736253002 |
9+
When consumer 'RX898' reads a DocumentReference with ID 'X26-000000000-000000000'
10+
Then the response status code is 404
11+
And the response is an OperationOutcome with 1 issue
12+
And the OperationOutcome contains the issue:
13+
"""
14+
{
15+
"severity": "error",
16+
"code": "not-found",
17+
"details": {
18+
"coding": [
19+
{
20+
"system": "https://fhir.nhs.uk/ValueSet/Spine-ErrorOrWarningCode-1",
21+
"code": "NO_RECORD_FOUND",
22+
"display": "No record found"
23+
}
24+
]
25+
},
26+
"diagnostics": "The requested DocumentReference could not be found"
27+
}
28+
"""
29+
30+
# TODO: This scenario is not valid as the ID is not valid - additional validation required
31+
Scenario: Invalid ID in path parameters
32+
Given the application 'DataShare' (ID 'z00z-y11y-x22x') is registered to access the API
33+
And the organisation 'RX898' is authorised to access pointer types:
34+
| system | value |
35+
| http://snomed.info/sct | 736253002 |
36+
When consumer 'RX898' reads a DocumentReference with ID 'X26`DROP TABLE 'pointers';--Something-000000000-000000000'
37+
Then the response status code is 404
38+
And the response is an OperationOutcome with 1 issue
39+
And the OperationOutcome contains the issue:
40+
"""
41+
{
42+
"severity": "error",
43+
"code": "not-found",
44+
"details": {
45+
"coding": [
46+
{
47+
"system": "https://fhir.nhs.uk/ValueSet/Spine-ErrorOrWarningCode-1",
48+
"code": "NO_RECORD_FOUND",
49+
"display": "No record found"
50+
}
51+
]
52+
},
53+
"diagnostics": "The requested DocumentReference could not be found"
54+
}
55+
"""
56+
57+
Scenario: No permissions to access any resources
58+
Given the application 'DataShare' (ID 'z00z-y11y-x22x') is registered to access the API
59+
And the organisation 'RX898' is authorised to access pointer types:
60+
| system | value |
61+
When consumer 'RX898' reads a DocumentReference with ID 'X26-000000000-000000000'
62+
Then the response status code is 403
63+
And the response is an OperationOutcome with 1 issue
64+
And the OperationOutcome contains the issue:
65+
"""
66+
{
67+
"severity": "error",
68+
"code": "forbidden",
69+
"details": {
70+
"coding": [
71+
{
72+
"system": "https://fhir.nhs.uk/ValueSet/Spine-ErrorOrWarningCode-1",
73+
"code": "ACCESS DENIED",
74+
"display": "Access has been denied to process this request"
75+
}
76+
]
77+
},
78+
"diagnostics": "Your organisation 'RX898' does not have permission to access this resource. Contact the onboarding team."
79+
}
80+
"""
81+
82+
Scenario: No permissions to access specific pointer type
83+
Given the application 'DataShare' (ID 'z00z-y11y-x22x') is registered to access the API
84+
And the organisation 'RX898' is authorised to access pointer types:
85+
| system | value |
86+
| http://snomed.info/sct | 736253002 |
87+
And a DocumentReference resource exists with values:
88+
| property | value |
89+
| id | 02V-1111111111-ReadDocRefNoAuthForType |
90+
| subject | 9278693472 |
91+
| status | current |
92+
| type | 887701000000100 |
93+
| contentType | application/pdf |
94+
| url | https://example.org/my-doc.pdf |
95+
| custodian | 02V |
96+
When consumer 'RX898' reads a DocumentReference with ID '02V-1111111111-ReadDocRefNoAuthForType'
97+
Then the response status code is 403
98+
And the response is an OperationOutcome with 1 issue
99+
And the OperationOutcome contains the issue:
100+
"""
101+
{
102+
"severity": "error",
103+
"code": "forbidden",
104+
"details": {
105+
"coding": [
106+
{
107+
"system": "https://fhir.nhs.uk/ValueSet/Spine-ErrorOrWarningCode-1",
108+
"code": "ACCESS DENIED",
109+
"display": "Access has been denied to process this request"
110+
}
111+
]
112+
},
113+
"diagnostics": "The requested DocumentReference is not of a type that this organisation is allowed to access"
114+
}
115+
"""
116+
117+
Scenario: No permissions to access any pointers in S3
118+
Given the application 'DataShare' (ID 'z00z-y11y-x22x') is registered to access the API
119+
And the application is configured to lookup permissions from S3
120+
And the organisation 'RX898' is authorised in S3 to access pointer types:
121+
| system | value |
122+
When consumer 'RX898' reads a DocumentReference with ID 'X26-000000000-000000000'
123+
Then the response status code is 403
124+
And the response is an OperationOutcome with 1 issue
125+
And the OperationOutcome contains the issue:
126+
"""
127+
{
128+
"severity": "error",
129+
"code": "forbidden",
130+
"details": {
131+
"coding": [
132+
{
133+
"system": "https://fhir.nhs.uk/ValueSet/Spine-ErrorOrWarningCode-1",
134+
"code": "ACCESS DENIED",
135+
"display": "Access has been denied to process this request"
136+
}
137+
]
138+
},
139+
"diagnostics": "Your organisation 'RX898' does not have permission to access this resource. Contact the onboarding team."
140+
}
141+
"""
142+
143+
Scenario: No permissions to access specific pointer type in S3
144+
Given the application 'DataShare' (ID 'z00z-y11y-x22x') is registered to access the API
145+
And the application is configured to lookup permissions from S3
146+
And the organisation 'RX898' is authorised in S3 to access pointer types:
147+
| system | value |
148+
| http://snomed.info/sct | 736253002 |
149+
And a DocumentReference resource exists with values:
150+
| property | value |
151+
| id | 02V-1111111111-ReadDocRefNoAuthForTypeS3 |
152+
| subject | 9278693472 |
153+
| status | current |
154+
| type | 887701000000100 |
155+
| contentType | application/pdf |
156+
| url | https://example.org/my-doc.pdf |
157+
| custodian | 02V |
158+
When consumer 'RX898' reads a DocumentReference with ID '02V-1111111111-ReadDocRefNoAuthForTypeS3'
159+
Then the response status code is 403
160+
And the response is an OperationOutcome with 1 issue
161+
And the OperationOutcome contains the issue:
162+
"""
163+
{
164+
"severity": "error",
165+
"code": "forbidden",
166+
"details": {
167+
"coding": [
168+
{
169+
"system": "https://fhir.nhs.uk/ValueSet/Spine-ErrorOrWarningCode-1",
170+
"code": "ACCESS DENIED",
171+
"display": "Access has been denied to process this request"
172+
}
173+
]
174+
},
175+
"diagnostics": "The requested DocumentReference is not of a type that this organisation is allowed to access"
176+
}
177+
"""

0 commit comments

Comments
 (0)