Skip to content

Commit 6021e6e

Browse files
adamwhitingnhsmegan-bower4
adamwhitingnhs
authored and
megan-bower4
committed
[PRMP-1184] Adjust DocumentStatus endpoint auth (#985)
1 parent be6b89e commit 6021e6e

File tree

3 files changed

+135
-6
lines changed

3 files changed

+135
-6
lines changed

‎app/cypress/e2e/1-ndr-smoke-tests/gp_user_workflows/upload_lloyd_george_is_bsol_gp_clinical_workflow.cy.js‎

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
import { pdsPatients } from '../../../support/patients';
2+
import { Roles } from '../../../support/roles';
3+
4+
const workspace = Cypress.env('WORKSPACE');
5+
6+
const baseUrl = Cypress.config('baseUrl');
7+
8+
const uploadedFilePathNames = [
9+
'cypress/fixtures/lg-files/zenia_lees/1of3_Lloyd_George_Record_[Zenia Ellisa LEES]_[9730153930]_[20-03-1929].pdf',
10+
'cypress/fixtures/lg-files/zenia_lees/2of3_Lloyd_George_Record_[Zenia Ellisa LEES]_[9730153930]_[20-03-1929].pdf',
11+
'cypress/fixtures/lg-files/zenia_lees/3of3_Lloyd_George_Record_[Zenia Ellisa LEES]_[9730153930]_[20-03-1929].pdf',
12+
];
13+
const uploadedFileNames = [
14+
'1of3_Lloyd_George_Record_[Zenia Ellisa LEES]_[9730153930]_[20-03-1929].pdf',
15+
'2of3_Lloyd_George_Record_[Zenia Ellisa LEES]_[9730153930]_[20-03-1929].pdf',
16+
'3of3_Lloyd_George_Record_[Zenia Ellisa LEES]_[9730153930]_[20-03-1929].pdf',
17+
];
18+
19+
const bucketName = `${workspace}-lloyd-george-store`;
20+
const referenceTableName = `${workspace}_LloydGeorgeReferenceMetadata`;
21+
const stitchTableName = `${workspace}_LloydGeorgeStitchJobMetadata`;
22+
23+
const patientVerifyUrl = '/patient/verify';
24+
const lloydGeorgeRecordUrl = '/patient/lloyd-george-record';
25+
const selectOrderUrl = '/patient/document-upload/select-order';
26+
const confirmationUrl = '/patient/document-upload/confirmation';
27+
28+
const activePatient = pdsPatients.activeNoUpload;
29+
30+
describe('GP Workflow: Upload Lloyd George record', () => {
31+
context('Upload a Lloyd George document', () => {
32+
beforeEach(() => {
33+
//delete any records present for the active patient
34+
cy.deleteItemsBySecondaryKeyFromDynamoDb(
35+
referenceTableName,
36+
'NhsNumberIndex',
37+
'NhsNumber',
38+
activePatient.toString(),
39+
);
40+
cy.deleteItemsBySecondaryKeyFromDynamoDb(
41+
stitchTableName,
42+
'NhsNumberIndex',
43+
'NhsNumber',
44+
activePatient.toString()
45+
);
46+
uploadedFileNames.forEach((file) => {
47+
cy.deleteFileFromS3(bucketName, file);
48+
});
49+
});
50+
51+
afterEach(() => {
52+
//clean up any records present for the active patient
53+
cy.deleteItemsBySecondaryKeyFromDynamoDb(
54+
referenceTableName,
55+
'NhsNumberIndex',
56+
'NhsNumber',
57+
activePatient.toString(),
58+
);
59+
cy.deleteItemsBySecondaryKeyFromDynamoDb(
60+
stitchTableName,
61+
'NhsNumberIndex',
62+
'NhsNumber',
63+
activePatient.toString()
64+
);
65+
uploadedFileNames.forEach((file) => {
66+
cy.deleteFileFromS3(bucketName, file);
67+
});
68+
});
69+
70+
it(
71+
'[Smoke] GP Clinical can upload multiple files and then view a Lloyd George record for an active patient with no record',
72+
{ tags: 'smoke', defaultCommandTimeout: 20000 },
73+
() => {
74+
cy.smokeLogin(Roles.SMOKE_GP_CLINICAL);
75+
76+
cy.navigateToPatientSearchPage();
77+
78+
cy.get('#nhs-number-input').should('exist');
79+
cy.get('#nhs-number-input').click();
80+
cy.get('#nhs-number-input').type(activePatient);
81+
cy.getByTestId('search-submit-btn').should('exist');
82+
cy.getByTestId('search-submit-btn').click();
83+
84+
cy.url({ timeout: 15000 }).should('contain', patientVerifyUrl);
85+
86+
cy.get('#verify-submit').should('exist');
87+
cy.get('#verify-submit').click();
88+
89+
cy.url().should('contain', lloydGeorgeRecordUrl);
90+
cy.getByTestId('no-records-title').should(
91+
'include.text',
92+
'This patient does not have a Lloyd George record',
93+
);
94+
cy.getByTestId('upload-patient-record-button').should('exist');
95+
cy.getByTestId('upload-patient-record-button').click();
96+
uploadedFilePathNames.forEach((file) => {
97+
cy.getByTestId('button-input').selectFile(file, { force: true });
98+
var index = uploadedFilePathNames.indexOf(file);
99+
cy.get('#selected-documents-table').should('contain', uploadedFileNames[index]);
100+
});
101+
cy.get('#continue-button').click();
102+
103+
cy.url().should('contain', selectOrderUrl);
104+
cy.get('#selected-documents-table').should('exist');
105+
uploadedFileNames.forEach((name) => {
106+
cy.get('#selected-documents-table').should('contain', name);
107+
});
108+
cy.getByTestId('form-submit-button').click();
109+
110+
cy.url().should('contain', confirmationUrl);
111+
uploadedFileNames.forEach((name) => {
112+
cy.get('#selected-documents-table').should('contain', name);
113+
});
114+
cy.getByTestId('confirm-button').click();
115+
116+
cy.getByTestId('upload-complete-page', { timeout: 25000 }).should('exist');
117+
118+
cy.getByTestId('upload-complete-card').should('be.visible');
119+
120+
cy.getByTestId('home-btn').eq(1).click();
121+
122+
cy.navigateToPatientSearchPage();
123+
124+
cy.get('#nhs-number-input').type(activePatient);
125+
cy.get('#search-submit').click();
126+
cy.wait(5000)
127+
128+
cy.get('.patient-results-form').submit();
129+
130+
cy.get("#pdf-viewer", { timeout: 20000 }).should('exist');
131+
});
132+
});
133+
});

‎lambdas/services/authoriser_service.py‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -121,9 +121,7 @@ def deny_access_policy(self, path, user_role, nhs_number: str = None):
121121
deny_resource = False
122122

123123
case "/DocumentStatus":
124-
deny_resource = (
125-
not patient_access_is_allowed or is_user_gp_clinical or is_user_pcse
126-
)
124+
deny_resource = not patient_access_is_allowed
127125

128126
case path if re.match(r"^/DocumentReview/[^/]+/[^/]+/Status$", path):
129127
deny_resource = False

‎lambdas/tests/unit/services/test_authoriser_service.py‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -74,10 +74,8 @@ def mocked_decode_method(auth_token: str, *_args, **_kwargs):
7474
[
7575
"/DocumentManifest",
7676
"/DocumentDelete",
77-
"/DocumentStatus",
7877
"/UploadState",
7978
"/VirusScan",
80-
8179
],
8280
)
8381
def test_deny_access_policy_returns_true_for_gp_clinical_on_paths(
@@ -92,7 +90,7 @@ def test_deny_access_policy_returns_true_for_gp_clinical_on_paths(
9290
assert actual == expected
9391

9492

95-
@pytest.mark.parametrize("test_path", ["/DocumentManifest", "/DocumentDelete", "Any"])
93+
@pytest.mark.parametrize("test_path", ["/DocumentManifest", "/DocumentDelete", "/DocumentStatus", "Any"])
9694
def test_deny_access_policy_returns_true_for_nhs_number_not_in_allowed(
9795
test_path,
9896
mock_auth_service: AuthoriserService,

0 commit comments

Comments
 (0)