Skip to content

Commit 6b1d47d

Browse files
ewan-IWewan-IW
authored
Merge pull request #35 from NHSDigital/AMB-1709-adding-auth-errors-to-proxy
Creating new PR for proxy error handling due to conflicts
2 parents a1e1af9 + b66a706 commit 6b1d47d

File tree

18 files changed

+302
-56
lines changed

18 files changed

+302
-56
lines changed

‎proxies/live/apiproxy/policies/AssignMessage.InvalidAccessToken.xml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
<AssignMessage async="false" continueOnError="false" enabled="true" name="AssignMessage.InvalidAccessToken">
2+
<Set>
3+
<StatusCode>401</StatusCode>
4+
<Payload contentType="application/json">
5+
{
6+
"resourceType": "OperationOutcome",
7+
"id": "a5abca2a-4eda-41da-b2cc-95d48c6b791d",
8+
"meta": {
9+
"profile": [
10+
"https://simplifier.net/guide/UKCoreDevelopment2/ProfileUKCore-OperationOutcome"
11+
]
12+
},
13+
"issue": [
14+
{
15+
"severity": "error",
16+
"code": "expired",
17+
"details": {
18+
"coding": [
19+
{
20+
"system": "https://fhir.nhs.uk/Codesystem/http-error-codes",
21+
"code": "SEND_UNAUTHORIZED"
22+
}
23+
]
24+
},
25+
"diagnostics": "The sender has not provided a token or it has expired or is otherwise invalid."
26+
}
27+
]
28+
}
29+
</Payload>
30+
</Set>
31+
<IgnoreUnresolvedVariables>true</IgnoreUnresolvedVariables>
32+
<AssignTo createNew="false" transport="http" type="response" />
33+
</AssignMessage>

‎proxies/live/apiproxy/policies/AssignMessage.InvalidOperation.xml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
<AssignMessage async="false" continueOnError="false" enabled="true" name="AssignMessage.InvalidOperation">
2+
<Set>
3+
<StatusCode>400</StatusCode>
4+
<Payload contentType="application/json">
5+
{
6+
"resourceType": "OperationOutcome",
7+
"id": "a5abca2a-4eda-41da-b2cc-95d48c6b791d",
8+
"meta": {
9+
"profile": [
10+
"https://simplifier.net/guide/UKCoreDevelopment2/ProfileUKCore-OperationOutcome"
11+
]
12+
},
13+
"issue": [
14+
{
15+
"severity": "error",
16+
"code": "invalid",
17+
"details": {
18+
"coding": [
19+
{
20+
"system": "https://fhir.nhs.uk/Codesystem/http-error-codes",
21+
"code": "INVALID_OPERATION"
22+
}
23+
]
24+
},
25+
"diagnostics": "Invalid operation."
26+
}
27+
]
28+
}
29+
</Payload>
30+
</Set>
31+
<IgnoreUnresolvedVariables>true</IgnoreUnresolvedVariables>
32+
<AssignTo createNew="false" transport="http" type="response" />
33+
</AssignMessage>

‎proxies/live/apiproxy/policies/AssignMessage.PermissionsError.xml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
<AssignMessage async="false" continueOnError="false" enabled="true" name="AssignMessage.PermissionsError">
2+
<Set>
3+
<StatusCode>403</StatusCode>
4+
<Payload contentType="application/json">
5+
{
6+
"resourceType": "OperationOutcome",
7+
"id": "a5abca2a-4eda-41da-b2cc-95d48c6b791d",
8+
"meta": {
9+
"profile": [
10+
"https://simplifier.net/guide/UKCoreDevelopment2/ProfileUKCore-OperationOutcome"
11+
]
12+
},
13+
"issue": [
14+
{
15+
"severity": "error",
16+
"code": "forbidden",
17+
"details": {
18+
"coding": [
19+
{
20+
"system": "https://fhir.nhs.uk/Codesystem/http-error-codes",
21+
"code": "SEND_UNAUTHORIZED"
22+
}
23+
]
24+
},
25+
"diagnostics": "The sender does not have permissions to access this resource. Please check your credentials and permissions."
26+
}
27+
]
28+
}
29+
</Payload>
30+
</Set>
31+
<IgnoreUnresolvedVariables>true</IgnoreUnresolvedVariables>
32+
<AssignTo createNew="false" transport="http" type="response" />
33+
</AssignMessage>

‎proxies/live/apiproxy/proxies/default.xml‎

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -42,8 +42,7 @@
4242
<Name>javascript.SetStatusResponse</Name>
4343
</Step>
4444
</Response>
45-
<Condition>(proxy.pathsuffix MatchesPath "/_status") and ((request.verb = "GET") or (request.verb = "HEAD"))
46-
</Condition>
45+
<Condition>(proxy.pathsuffix MatchesPath "/_status") and ((request.verb = "GET") or (request.verb = "HEAD"))</Condition>
4746
</Flow>
4847
</Flows>
4948
<PostClientFlow name="PostClientFlow">
@@ -69,9 +68,4 @@
6968
<RouteRule name="immunisation-fhir-api-target">
7069
<TargetEndpoint>immunisation-fhir-api-target</TargetEndpoint>
7170
</RouteRule>
72-
<DefaultFaultRule>
73-
<Step>
74-
<Name>AssignMessage.Errors.CatchAllMessage</Name>
75-
</Step>
76-
</DefaultFaultRule>
7771
</ProxyEndpoint>

‎proxies/live/apiproxy/targets/target.xml‎

Lines changed: 26 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,34 @@
11
<TargetEndpoint name="immunisation-fhir-api-target">
22
<PreFlow>
33
<Request>
4-
<Step>
5-
<Name>OauthV2.VerifyAccessTokenAppLevel3OrCis2Aal3</Name>
6-
</Step>
7-
<Step>
8-
<Name>FlowCallout.ApplyRateLimiting</Name>
9-
</Step>
4+
<Step>
5+
<Name>OauthV2.VerifyAccessTokenAppLevel3OrCis2Aal3</Name>
6+
</Step>
7+
<Step>
8+
<Name>FlowCallout.ApplyRateLimiting</Name>
9+
</Step>
1010
</Request>
1111
</PreFlow>
12-
<FaultRules>
13-
<FaultRule name="access_token_expired">
14-
<Step>
15-
<Name>ExtractVariables.OAuthErrorFaultString</Name>
16-
</Step>
17-
<Step>
18-
<Name>AssignMessage.OAuthPolicyErrorResponse</Name>
19-
</Step>
20-
<Condition>oauthV2.OauthV2.VerifyAccessToken.failed</Condition>
21-
</FaultRule>
22-
</FaultRules>
12+
<FaultRules>
13+
<FaultRule name="400_invalid_operation">
14+
<Condition>(oauthV2.failed == false) and (request.verb = "GET")</Condition>
15+
<Step>
16+
<Name>AssignMessage.InvalidOperation</Name>
17+
</Step>
18+
</FaultRule>
19+
<FaultRule name="401_invalid_token">
20+
<Condition>oauthV2.OauthV2.VerifyAccessTokenAppLevel3OrCis2Aal3.fault.cause == "Invalid access token"</Condition>
21+
<Step>
22+
<Name>AssignMessage.InvalidAccessToken</Name>
23+
</Step>
24+
</FaultRule>
25+
<FaultRule name="403_invalid_permissions">
26+
<Condition>(oauthV2.OauthV2.VerifyAccessTokenAppLevel3OrCis2Aal3.fault.cause != "Invalid access token") and (oauthV2.OauthV2.VerifyAccessTokenAppLevel3OrCis2Aal3.failed == true)</Condition>
27+
<Step>
28+
<Name>AssignMessage.PermissionsError</Name>
29+
</Step>
30+
</FaultRule>
31+
</FaultRules>
2332
<HTTPTargetConnection>
2433
<URL>{{ DOMAIN_ENDPOINT }}</URL>
2534
<Properties>

‎specification/examples/OperationOutcome/400-invalid_operation.json‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
{
2+
"resourceType": "OperationOutcome",
3+
"id": "a5abca2a-4eda-41da-b2cc-95d48c6b791d",
4+
"meta": {
5+
"profile": [
6+
"https://simplifier.net/guide/UKCoreDevelopment2/ProfileUKCore-OperationOutcome"
7+
]
8+
},
9+
"issue": [
10+
{
11+
"severity": "error",
12+
"code": "invalid",
13+
"details": {
14+
"coding": [
15+
{
16+
"system": "https://fhir.nhs.uk/Codesystem/http-error-codes",
17+
"code": "INVALID_OPERATION"
18+
}
19+
]
20+
},
21+
"diagnostics": "Invalid operation."
22+
}
23+
]
24+
}

‎specification/examples/OperationOutcome/401-invalid_access_token.json‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
{
2+
"resourceType": "OperationOutcome",
3+
"id": "a5abca2a-4eda-41da-b2cc-95d48c6b791d",
4+
"meta": {
5+
"profile": [
6+
"https://simplifier.net/guide/UKCoreDevelopment2/ProfileUKCore-OperationOutcome"
7+
]
8+
},
9+
"issue": [
10+
{
11+
"severity": "error",
12+
"code": "expired",
13+
"details": {
14+
"coding": [
15+
{
16+
"system": "https://fhir.nhs.uk/Codesystem/http-error-codes",
17+
"code": "SEND_UNAUTHORIZED"
18+
}
19+
]
20+
},
21+
"diagnostics": "The sender has not provided a token or it has expired or is otherwise invalid."
22+
}
23+
]
24+
}

‎specification/examples/OperationOutcome/403-unauthorized.json‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
{
2+
"resourceType": "OperationOutcome",
3+
"id": "a5abca2a-4eda-41da-b2cc-95d48c6b791d",
4+
"meta": {
5+
"profile": [
6+
"https://simplifier.net/guide/UKCoreDevelopment2/ProfileUKCore-OperationOutcome"
7+
]
8+
},
9+
"issue": [
10+
{
11+
"severity": "error",
12+
"code": "forbidden",
13+
"details": {
14+
"coding": [
15+
{
16+
"system": "https://fhir.nhs.uk/Codesystem/http-error-codes",
17+
"code": "SEND_UNAUTHORIZED"
18+
}
19+
]
20+
},
21+
"diagnostics": "The sender does not have permissions to access this resource. Please check your credentials and permissions."
22+
}
23+
]
24+
}

‎terraform/batch-processing/iam.tf‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,22 @@
11
resource "aws_iam_role" batch_processing_lambda_role {
22
name = "${var.short_prefix}-batch-processing-lambda-role"
33
assume_role_policy = <<EOF
4+
{
5+
"Version": "2012-10-17",
6+
"Statement": [
47
{
5-
"Version": "2012-10-17",
6-
"Statement": [
7-
{
8-
"Action": [
9-
"sts:AssumeRole"
10-
],
11-
"Principal": {
12-
"Service": "lambda.amazonaws.com"
13-
},
14-
"Effect": "Allow",
15-
"Sid": ""
16-
}
17-
]
8+
"Action": [
9+
"sts:AssumeRole"
10+
],
11+
"Principal": {
12+
"Service": "lambda.amazonaws.com"
13+
},
14+
"Effect": "Allow",
15+
"Sid": ""
1816
}
19-
EOF
17+
]
18+
}
19+
EOF
2020
}
2121

2222
resource "aws_iam_policy" batch_processing_lambda_policy {

‎terraform/lambda/iam.tf‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,20 @@
11
resource "aws_iam_role" lambda_role {
22
name = "${var.short_prefix}-lambda-role"
33
assume_role_policy = <<EOF
4+
{
5+
"Version": "2012-10-17",
6+
"Statement": [
47
{
5-
"Version": "2012-10-17",
6-
"Statement": [
7-
{
8-
"Action": "sts:AssumeRole",
9-
"Principal": {
10-
"Service": "lambda.amazonaws.com"
11-
},
12-
"Effect": "Allow",
13-
"Sid": ""
14-
}
15-
]
8+
"Action": "sts:AssumeRole",
9+
"Principal": {
10+
"Service": "lambda.amazonaws.com"
11+
},
12+
"Effect": "Allow",
13+
"Sid": ""
1614
}
17-
EOF
15+
]
16+
}
17+
EOF
1818
}
1919

2020

0 commit comments

Comments
 (0)