Merge pull request #370 from NHSDigital/revert-353-VED-73-Read-S-flag-obfuscation

Revert "VED-73- drop obfuscation for s-flag-patient"

Author: Valswyn-NHS

backend/.envrc.default

@@ -1,3 +1,3 @@
-layout pyenv 3.10.16
+layout pyenv 3.10.12
 
-dotenv
+dotenv

backend/.gitignore

@@ -1,2 +1,2 @@
 build
-.venv
+.venv

backend/src/fhir_service.py

@@ -85,19 +85,26 @@ def get_immunization_by_id(self, imms_id: str, imms_vax_type_perms: str) -> Opti
         if not (imms_resp := self.immunization_repo.get_immunization_by_id(imms_id, imms_vax_type_perms)):
             return None
 
-        # Returns the Immunisation full resource with no obfuscation
-        resource = imms_resp.get("Resource", {})
-        imms_filtered_for_read = Filter.read(resource) if resource else {}
+        # Remove fields rom the imms resource which are not to be returned for read
+        imms_filtered_for_read = Filter.read(imms_resp.get("Resource", {}))
 
+        # Handle s-flag filtering, where applicable
+        if not (nhs_number := obtain_field_value(imms_filtered_for_read, FieldNames.patient_identifier_value)):
+            imms_filtered_for_read_and_s_flag = imms_filtered_for_read
+        else:
+            if patient := self.pds_service.get_patient_details(nhs_number):
+                imms_filtered_for_read_and_s_flag = handle_s_flag(imms_filtered_for_read, patient)
+            else:
+                raise UnhandledResponseError("unable to validate NHS number with downstream service")
 
         return {
             "Version": imms_resp.get("Version", ""),
-            "Resource": Immunization.parse_obj(imms_filtered_for_read),
+            "Resource": Immunization.parse_obj(imms_filtered_for_read_and_s_flag),
         }
 
     def get_immunization_by_id_all(self, imms_id: str, imms: dict) -> Optional[dict]:
         """
-        Get an Immunization by its ID. Return None if it is not found. If the patient doesn't have an NHS number,
+        Get an Immunization by its ID. Return None if not found. If the patient doesn't have an NHS number,
         return the Immunization without calling PDS or checking S flag.
         """
         imms["id"] = imms_id

backend/tests/test_fhir_service.py

@@ -204,7 +204,23 @@ def test_get_immunization_by_id_patient_not_restricted(self):
 
         # Then
         self.assertEqual(actual_output["Resource"], expected_output)
-       
+
+    def test_get_immunization_by_id_patient_restricted(self):
+        """it should return a filtered Immunization when patient is restricted"""
+        imms_id = "restricted_id"
+        immunization_data = load_json_data("completed_covid19_immunization_event.json")
+        filtered_immunization = load_json_data("completed_covid19_immunization_event_filtered_for_s_flag_and_read.json")
+        self.imms_repo.get_immunization_by_id.return_value = {"Resource": immunization_data}
+        patient_data = {"meta": {"security": [{"code": "R"}]}}
+        self.fhir_service.pds_service.get_patient_details.return_value = patient_data
+
+        # When
+        resp_imms = self.fhir_service.get_immunization_by_id(imms_id, "COVID19:read")
+        act_res = resp_imms["Resource"]
+        filtered_immunization_res = Immunization.parse_obj(filtered_immunization)
+        # Then
+        self.assertEqual(act_res, filtered_immunization_res)
+
     def test_pre_validation_failed(self):
         """it should throw exception if Immunization is not valid"""
         imms_id = "an-id"

delta_backend/src/delta.py

@@ -84,7 +84,7 @@ def handler(event, context):
                             "SupplierSystem": supplier_system,
                             "DateTimeStamp": approximate_creation_time.isoformat(),
                             "Source": delta_source,
-                            "Imms": flat_json,
+                            "Imms": str(flat_json),
                             "ExpiresAt": expiry_time_epoch,
                         }
                     )

delta_backend/tests/test_convert_to_flat_json.py

@@ -89,11 +89,11 @@ def assert_dynamodb_record(self, operation_flag, items, expected_values, expecte
         self.assertGreater(len(filtered_items), 0, f"No matching item found for {operation_flag}")
 
         imms_data = filtered_items[0]["Imms"]
-        self.assertIsInstance(imms_data, list)
+        self.assertIsInstance(imms_data, str)
         self.assertGreater(len(imms_data), 0)
 
         # Check Imms JSON structure matches exactly
-        self.assertEqual(imms_data, expected_imms, "Imms data does not match expected JSON structure")
+        self.assertEqual(imms_data, str(expected_imms), "Imms data does not match expected JSON structure")
 
         for key, expected_value in expected_values.items():
             self.assertIn(key, filtered_items[0], f"{key} is missing")
@@ -1067,4 +1067,4 @@ def _run_test_practitioner_surname(self, expected_forename):
         self.assertEqual(flat_json[0]["PERFORMING_PROFESSIONAL_SURNAME"], expected_forename)
 
     if __name__ == "__main__":
-        unittest.main()
+        unittest.main()

delta_backend/tests/utils_for_converter_tests.py

@@ -187,7 +187,7 @@ def get_expected_imms(expected_action_flag):
                 "PRIMARY_SOURCE": "true",
                 "VACCINATION_PROCEDURE_CODE": "13246814444444",
                 "VACCINATION_PROCEDURE_TERM": "Administration of first dose of severe acute respiratory syndrome coronavirus 2 vaccine (procedure)",
-                "DOSE_SEQUENCE": Decimal("1"),
+                "DOSE_SEQUENCE": 1,
                 "VACCINE_PRODUCT_CODE": "39114911000001105",
                 "VACCINE_PRODUCT_TERM": "COVID-19 Vaccine Vaxzevria (ChAdOx1 S [recombinant]) not less than 2.5x100,000,000 infectious units/0.5ml dose suspension for injection multidose vials (AstraZeneca UK Ltd) (product)",
                 "VACCINE_MANUFACTURER": "AstraZeneca Ltd",
@@ -379,7 +379,7 @@ def get_expected_imms_error_output(expected_action_flag):
                 "PRIMARY_SOURCE": "true",
                 "VACCINATION_PROCEDURE_CODE": "13246814444444",
                 "VACCINATION_PROCEDURE_TERM": "Administration of first dose of severe acute respiratory syndrome coronavirus 2 vaccine (procedure)",
-                "DOSE_SEQUENCE": Decimal("1"),
+                "DOSE_SEQUENCE": 1,
                 "VACCINE_PRODUCT_CODE": "39114911000001105",
                 "VACCINE_PRODUCT_TERM": "COVID-19 Vaccine Vaxzevria (ChAdOx1 S [recombinant]) not less than 2.5x100,000,000 infectious units/0.5ml dose suspension for injection multidose vials (AstraZeneca UK Ltd) (product)",
                 "VACCINE_MANUFACTURER": "AstraZeneca Ltd",