[ERSSUP-89806]-[]-[Fixed reason phrases for error responses]-[JW]

Author: nhsd-jack-wainwright

proxies/live/apiproxy/policies/AssignMessage.OperationOutcomeErrorResponse.xml

@@ -1,7 +1,7 @@
 <AssignMessage async="false" continueOnError="false" enabled="true" name="AssignMessage.OperationOutcomeErrorResponse">
     <Set>
         <StatusCode>{status_code}</StatusCode>
-        <ReasonPhrase>Unauthorized</ReasonPhrase>
+        <ReasonPhrase>{reason_phrase}</ReasonPhrase>
         <Payload contentType="application/fhir+json" variablePrefix="%" variableSuffix="#">{ "resourceType": "OperationOutcome", "meta": { "lastUpdated": "%current_timestamp#", "profile" : [ "%op_outcome_fhir_profile#" ] }, "issue": [ { "severity": "error", "code": "%op_outcome_issue_code#", "details": { "coding": [ { "system": "%op_outcome_issue_details_coding_system#", "code": "%op_outcome_issue_details_coding_code#" } ] }, "diagnostics": "%faultstring#" } ] }</Payload>
     </Set>
     <IgnoreUnresolvedVariables>true</IgnoreUnresolvedVariables>

proxies/live/apiproxy/policies/AssignMessage.SetOperationOutcomeInvalidBusinessFunction.xml

@@ -11,4 +11,8 @@
         <Name>status_code</Name>
         <Value>403</Value>
     </AssignVariable>
+    <AssignVariable>
+        <Name>reason_phrase</Name>
+        <Value>Forbidden</Value>
+    </AssignVariable>
 </AssignMessage>

proxies/live/apiproxy/policies/AssignMessage.SetOperationOutcomeIssueIal.xml

@@ -3,6 +3,10 @@
         <Name>status_code</Name>
         <Value>401</Value>
     </AssignVariable>
+    <AssignVariable>
+        <Name>reason_phrase</Name>
+        <Value>Unauthorized</Value>
+    </AssignVariable>
     <AssignVariable>
         <Name>op_outcome_issue_code</Name>
         <Value>forbidden</Value>

proxies/live/apiproxy/policies/AssignMessage.SetOperationOutcomeMissingAsid.xml

@@ -11,4 +11,8 @@
         <Name>status_code</Name>
         <Value>403</Value>
     </AssignVariable>
+    <AssignVariable>
+        <Name>reason_phrase</Name>
+        <Value>Forbidden</Value>
+    </AssignVariable>
 </AssignMessage>

tests/integration/test_headers.py

@@ -116,6 +116,8 @@ async def test_headers_on_echo_target_with_app_restricted_business_function(
             + str(response.status_code)
         )
 
+        assert response.reason == "Forbidden"
+
         # Verify the OperationOutcome payload
         response_data = response.json()
         assert response_data["resourceType"] == "OperationOutcome"
@@ -508,6 +510,8 @@ def test_unknown_access_code(
             response.status_code
         )
 
+        assert response.reason == "Unauthorized"
+
         if not is_operation_outcome:
             assert len(response.content) == 0
         else: