Skip to content

Commit 086ec64

Browse files
kevinmason-nhskevinmason-nhs
committed
adds EuoAllowListVerify functionality
1 parent 5bd67d2 commit 086ec64

File tree

4 files changed

+57
-44
lines changed

4 files changed

+57
-44
lines changed

‎proxies/live/apiproxy/policies/FlowCallout.EUOAllowlistVerify.xml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
2+
<FlowCallout async="false" continueOnError="false" enabled="true" name="FlowCallout.EUOAllowlistVerify">
3+
<DisplayName>EUOAllowlistVerify</DisplayName>
4+
<SharedFlowBundle>EUOAllowlistVerify</SharedFlowBundle>
5+
</FlowCallout>

‎proxies/live/apiproxy/policies/FlowCallout.ExtendedAttributes.xml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
2+
<FlowCallout async="false" continueOnError="false" enabled="true" name="FlowCallout.ExtendedAttributes">
3+
<DisplayName>Extract extended attribute</DisplayName>
4+
<SharedFlowBundle>ExtendedAttributes</SharedFlowBundle>
5+
</FlowCallout>

‎proxies/live/apiproxy/proxies/default.xml‎

Lines changed: 33 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -1,57 +1,54 @@
11
<ProxyEndpoint name="default">
22
<Flows>
3-
<Flow name="AddPayloadToPing">
4-
<Description/>
5-
<Request/>
6-
<Response>
7-
<Step>
8-
<Name>AssignMessage.AddPayloadToPing</Name>
9-
</Step>
10-
</Response>
11-
<Condition>(proxy.pathsuffix MatchesPath "/_ping") and ((request.verb = "GET") or (request.verb = "HEAD"))</Condition>
12-
</Flow>
13-
<Flow name="StatusEndpoint">
14-
<Description/>
15-
<Request>
16-
<Step>
17-
<Name>KeyValueMapOperations.GetSharedSecureVariables</Name>
18-
</Step>
19-
<Step>
20-
<Condition>(private.apigee.status-endpoint-api-key NotEquals request.header.apikey) or (private.apigee.status-endpoint-api-key Is null)</Condition>
21-
<Name>RaiseFault.401Unauthorized</Name>
22-
</Step>
23-
<Step>
24-
<Name>ServiceCallout.CallHealthcheckEndpoint</Name>
25-
</Step>
26-
</Request>
27-
<Response>
28-
<Step>
29-
<Name>javascript.SetStatusResponse</Name>
30-
</Step>
31-
</Response>
32-
<Condition>(proxy.pathsuffix MatchesPath "/_status") and ((request.verb = "GET") or (request.verb = "HEAD"))</Condition>
33-
</Flow>
3+
<Flow name="AddPayloadToPing">
4+
<Description/>
5+
<Request/>
6+
<Response>
7+
<Step>
8+
<Name>AssignMessage.AddPayloadToPing</Name>
9+
</Step>
10+
</Response>
11+
<Condition>(proxy.pathsuffix MatchesPath "/_ping") and ((request.verb = "GET") or (request.verb = "HEAD"))</Condition>
12+
</Flow>
13+
<Flow name="StatusEndpoint">
14+
<Description/>
15+
<Request>
16+
<Step>
17+
<Name>KeyValueMapOperations.GetSharedSecureVariables</Name>
18+
</Step>
19+
<Step>
20+
<Condition>(private.apigee.status-endpoint-api-key NotEquals request.header.apikey) or (private.apigee.status-endpoint-api-key Is null)</Condition>
21+
<Name>RaiseFault.401Unauthorized</Name>
22+
</Step>
23+
<Step>
24+
<Name>ServiceCallout.CallHealthcheckEndpoint</Name>
25+
</Step>
26+
</Request>
27+
<Response>
28+
<Step>
29+
<Name>javascript.SetStatusResponse</Name>
30+
</Step>
31+
</Response>
32+
<Condition>(proxy.pathsuffix MatchesPath "/_status") and ((request.verb = "GET") or (request.verb = "HEAD"))</Condition>
33+
</Flow>
3434
</Flows>
35-
3635
<PreFlow/>
37-
3836
<PostClientFlow>
3937
<Response>
4038
<Step>
4139
<Name>FlowCallout.LogToSplunk</Name>
4240
</Step>
4341
</Response>
4442
</PostClientFlow>
45-
4643
<HTTPProxyConnection>
4744
<BasePath>{{ SERVICE_BASE_PATH }}</BasePath>
4845
<VirtualHost>secure</VirtualHost>
4946
</HTTPProxyConnection>
5047
<RouteRule name="NoRoutePing">
51-
<Condition>(proxy.pathsuffix MatchesPath "/_ping") and ((request.verb = "GET") or (request.verb = "HEAD"))</Condition>
48+
<Condition>(proxy.pathsuffix MatchesPath "/_ping") and ((request.verb = "GET") or (request.verb = "HEAD"))</Condition>
5249
</RouteRule>
5350
<RouteRule name="NoRouteStatus">
54-
<Condition>(proxy.pathsuffix MatchesPath "/_status") and ((request.verb = "GET") or (request.verb = "HEAD"))</Condition>
51+
<Condition>(proxy.pathsuffix MatchesPath "/_status") and ((request.verb = "GET") or (request.verb = "HEAD"))</Condition>
5552
</RouteRule>
5653
<RouteRule name="e-referrals-service-api-target">
5754
<TargetEndpoint>e-referrals-service-api-target</TargetEndpoint>

‎proxies/live/apiproxy/targets/ers-target.xml‎

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -154,7 +154,14 @@
154154
<Flows>
155155
<Flow name="user-restricted-flow">
156156
<Condition>(accesstoken.auth_type == "user")</Condition>
157-
<Request><!--AUTHORISED_APPLICATION business function is not supported in user restricted flow --><Step>
157+
<Response/>
158+
<Request><Step>
159+
<Name>FlowCallout.ExtendedAttributes</Name>
160+
</Step> <Step>
161+
<Name>FlowCallout.EUOAllowlistVerify</Name>
162+
<!-- Change this to be inline using the app attribute -->
163+
<Condition>(verifyapikey.Verify‑API‑Key.app.EUOAllowlistEnabled == true)</Condition>
164+
</Step> <!--AUTHORISED_APPLICATION business function is not supported in user restricted flow --><Step>
158165
<Name>RaiseFault.403Forbidden</Name>
159166
<Condition>(request.header.nhsd-ers-business-function == "AUTHORISED_APPLICATION")</Condition>
160167
</Step> <Step>
@@ -181,31 +188,30 @@
181188
<Condition>(request.header.nhsd-ers-referral-id ~~ ".+")</Condition>
182189
</Step> <Step>
183190
<Name>AssignMessage.Remove.x-request-id-header</Name>
184-
</Step><Step>
191+
</Step> <Step>
185192
<Name>AssignMessage.Set.x-ers-authentication-assurance-level-header</Name>
186-
</Step><Step>
193+
</Step> <Step>
187194
<Name>AssignMessage.Set.x-ers-amr-header</Name>
188-
</Step><Step>
195+
</Step> <Step>
189196
<Name>AssignMessage.Set.x-ers-id-assurance-level-header</Name>
190-
</Step><Step>
197+
</Step> <Step>
191198
<Condition>(request.header.x-ers-id-assurance-level LesserThan 3)</Condition>
192199
<Name>RaiseFault.401InsufficientIal</Name>
193-
</Step> {% if ALLOW_ECHO_TARGET | default(false) == true %}<Step>
200+
</Step> {% if ALLOW_ECHO_TARGET | default(false) == true %} <Step>
194201
<Name>AssignMessage.SetEchoTarget</Name>
195202
<Condition>(request.header.echo)</Condition>
196203
</Step> {% endif %} {% if '--ft-' in (ERS_TARGET_SERVER | default('e-referrals-service-api')) %} <Step>
197204
<Name>AssignMessage.SetTruststore</Name>
198205
<!--Condition is implemented this way around to account for isEchoCall being null (https://docs.apigee.com/api-platform/reference/conditions-reference#behaviorofnulloperandsinconditionalstatements)-->
199206
<Condition>(isEchoCall != true )</Condition>
200-
</Step><Step>
207+
</Step> <Step>
201208
<Name>AssignMessage.SetEchoTruststore</Name>
202209
<Condition>(isEchoCall == true)</Condition>
203210
</Step> {% endif %} <Step>
204211
<!--This should always be the last Step - as it is just before the message is sent - so the initial request stays intact for as long as possible.
205212
The Swapping of the Request Headers converts X-Correlation-ID to NHSD-Correlation-ID before sending to backend. -->
206213
<Name>AssignMessage.Swap.CorrelationHeader</Name>
207214
</Step></Request>
208-
<Response/>
209215
</Flow>
210216
<Flow name="app-restricted-flow">
211217
<Condition>(accesstoken.auth_type == "app")</Condition>

0 commit comments

Comments
 (0)