sanity check

Author: Akol125

backend/src/fhir_controller.py

@@ -431,9 +431,6 @@ def search_immunizations(self, aws_event: APIGatewayProxyEventV1) -> dict:
                 for vaccine_type in search_params.immunization_targets
                 if ApiOperationCode.SEARCH in expanded_permissions.get(vaccine_type.lower(), [])
             ]
-            # vax_type_perms = _expand_permissions(imms_vax_type_perms, ApiOperationCode.SEARCH)
-            # vax_type_perm = [ vaccine_type for vaccine_type in search_params.immunization_targets 
-            #                  if f"{vaccine_type.lower()}.{ApiOperationCode.SEARCH}" in vax_type_perms ]
             if not vax_type_perm:
                 raise UnauthorizedVaxError
         except UnauthorizedVaxError as unauthorized:
@@ -670,5 +667,5 @@ def create_response(status_code, body=None, headers=None):
     def _identify_supplier_system(aws_event):
         supplier_system = aws_event["headers"]["SupplierSystem"]
         if not supplier_system:
-            raise UnauthorizedSystemError("SupplierSystem header is missing or empty.")
+            return self.create_response(403, unauthorized.to_operation_outcome())
         return supplier_system

backend/src/fhir_repository.py

@@ -106,28 +106,23 @@ def get_immunization_by_identifier(
 
     def get_immunization_by_id(self, imms_id: str, imms_vax_type_perms: str) -> Optional[dict]:
         response = self.table.get_item(Key={"PK": _make_immunization_pk(imms_id)})
+        item = response.get("Item")
 
-        if "Item" in response:
-            resp = dict()
-            if "DeletedAt" in response["Item"]:
-                if response["Item"]["DeletedAt"] == "reinstated":
-                    vaccine_type = self._vaccine_type(response["Item"]["PatientSK"])
-                    if not validate_permissions(imms_vax_type_perms,ApiOperationCode.READ, [vaccine_type]):
-                        raise UnauthorizedVaxError()
-                    resp["Resource"] = json.loads(response["Item"]["Resource"])
-                    resp["Version"] = response["Item"]["Version"]
-                    return resp
-                else:
-                    return None
-            else:
-                vaccine_type = self._vaccine_type(response["Item"]["PatientSK"])
-                if not validate_permissions(imms_vax_type_perms,ApiOperationCode.READ, [vaccine_type]):
-                    raise UnauthorizedVaxError()
-                resp["Resource"] = json.loads(response["Item"]["Resource"])
-                resp["Version"] = response["Item"]["Version"]
-                return resp
-        else:
+        if not item:
             return None
+        if item.get("DeletedAt") and item["DeletedAt"] != "reinstated":
+            return None
+
+        # Get vaccine type + validate permissions
+        vaccine_type = self._vaccine_type(item["PatientSK"])
+        if not validate_permissions(imms_vax_type_perms, ApiOperationCode.READ, [vaccine_type]):
+            raise UnauthorizedVaxError()
+
+        # Build response
+        return {
+            "Resource": json.loads(item["Resource"]),
+            "Version": item["Version"]
+        }
 
     def get_immunization_by_id_all(self, imms_id: str, imms: dict) -> Optional[dict]:
         response = self.table.get_item(Key={"PK": _make_immunization_pk(imms_id)})
@@ -355,36 +350,39 @@ def _perform_dynamo_update(
                 )
 
     def delete_immunization(
-        self, imms_id: str, imms_vax_type_perms: str, supplier_system: str
-    ) -> dict:
+            self, imms_id: str, imms_vax_type_perms: str, supplier_system: str) -> dict:
         now_timestamp = int(time.time())
+        
         try:
-            resp = self.table.get_item(Key={"PK": _make_immunization_pk(imms_id)})
-
-            if "Item" in resp:
-                if "DeletedAt" in resp["Item"]:
-                    if resp["Item"]["DeletedAt"] == "reinstated":
-                        pass
-                vaccine_type = self._vaccine_type(resp["Item"]["PatientSK"])
+            item = self.table.get_item(Key={"PK": _make_immunization_pk(imms_id)}).get("Item")
+            if not item:
+                raise ResourceNotFoundError(resource_type="Immunization", resource_id=imms_id)
+            
+            if item.get("DeletedAt") == "reinstated":
+                vaccine_type = self._vaccine_type(item["PatientSK"])
                 if not validate_permissions(imms_vax_type_perms, ApiOperationCode.DELETE, [vaccine_type]):
                     raise UnauthorizedVaxError()
 
+            # Proceed with delete update
             response = self.table.update_item(
                 Key={"PK": _make_immunization_pk(imms_id)},
-                UpdateExpression="SET DeletedAt = :timestamp, Operation = :operation, SupplierSystem = :supplier_system",
+                UpdateExpression=(
+                    "SET DeletedAt = :timestamp, Operation = :operation, SupplierSystem = :supplier_system"
+                ),
                 ExpressionAttributeValues={
                     ":timestamp": now_timestamp,
                     ":operation": "DELETE",
                     ":supplier_system": supplier_system,
                 },
                 ReturnValues="ALL_NEW",
-                ConditionExpression=Attr("PK").eq(_make_immunization_pk(imms_id))
-                & (Attr("DeletedAt").not_exists() | Attr("DeletedAt").eq("reinstated")),
+                ConditionExpression=(
+                    Attr("PK").eq(_make_immunization_pk(imms_id)) &
+                    (Attr("DeletedAt").not_exists() | Attr("DeletedAt").eq("reinstated"))
+                ),
             )
+            
             return self._handle_dynamo_response(response)
-
         except botocore.exceptions.ClientError as error:
-            # Either resource didn't exist or it has already been deleted. See ConditionExpression in the request
             if error.response["Error"]["Code"] == "ConditionalCheckFailedException":
                 raise ResourceNotFoundError(resource_type="Immunization", resource_id=imms_id)
             else:

backend/tests/.coverage

@@ -523,19 +523,11 @@ def test_unauthorised_vax_delete(self):
                     "Resource": json.dumps({"foo": "bar"}),
                     "Version": 1,
                     "PatientSK": "FLU#2516525251",
+                    "DeletedAt": "reinstated"
                 }
             }
         )
 
-        self.repository.table.update_item.return_value = {
-        "ResponseMetadata": {
-            "HTTPStatusCode": 200
-        },
-        "Attributes": {
-            "Resource": json.dumps({"id": "valid-id", "status": "deleted"})
-        }
-    }
-
         with self.assertRaises(UnauthorizedVaxError) as e:
             self.repository.delete_immunization(imms_id, ["COVID19.CRUD"], "Test")