CCM-11595 - Level 3 auth proxy (#116)

nhsd-david-wass · web-flow · commit a3ea2e257e08 · 2025-08-20T14:05:28.000+01:00
* Level 3 auth proxy

* Level0 for PRs
diff --git a/.github/actions/build-proxies/action.yml b/.github/actions/build-proxies/action.yml
@@ -54,7 +54,12 @@ runs:
       working-directory: .
       shell: bash
       run: |
-        make build-json-oas-spec APIM_ENV=dev
+        if [ -z $PR_NUMBER ]
+        then
+          make build-json-oas-spec APIM_ENV=dev
+        else
+          make build-json-oas-spec APIM_ENV=dev-pr
+        fi
 
     - name: Set target
       shell: bash
diff --git a/.tool-versions b/.tool-versions
@@ -8,6 +8,7 @@ terraform 1.10.1
 terraform-docs 0.19.0
 trivy 0.61.0
 vale 3.6.0
+poetry 2.1.4
 
 # ==============================================================================
 # The section below is reserved for Docker image versions.
diff --git a/Makefile b/Makefile
@@ -53,9 +53,16 @@ set-access: guard-APIM_ENV
 	envsubst '$${ACCESS}' \
 	< specification/api/components/x-nhsd-apim/access-template.yml > specification/api/components/x-nhsd-apim/access.yml
 
+set-security: guard-APIM_ENV
+	@ SECURITY=security-$$APIM_ENV.yml \
+	envsubst '$${SECURITY}' \
+	< specification/api/components/security/security-template.yml > specification/api/components/security/security.yml
+
 construct-spec: guard-APIM_ENV
 	$(MAKE) set-target APIM_ENV=$$APIM_ENV
 	$(MAKE) set-access APIM_ENV=$$APIM_ENV
+	$(MAKE) set-security APIM_ENV=$$APIM_ENV
+
 
 
 build-json-oas-spec: guard-APIM_ENV
diff --git a/specification/api/components/security/security-dev-pr.yml b/specification/api/components/security/security-dev-pr.yml
@@ -0,0 +1 @@
+app-level0: []
diff --git a/specification/api/components/security/security-dev.yml b/specification/api/components/security/security-dev.yml
@@ -0,0 +1 @@
+app-level3: [ ]
diff --git a/specification/api/components/security/security-sandbox.yml b/specification/api/components/security/security-sandbox.yml
@@ -0,0 +1 @@
+app-level0: []
diff --git a/specification/api/components/security/security-template.yml b/specification/api/components/security/security-template.yml
@@ -0,0 +1 @@
+$ref: $SECURITY
diff --git a/specification/api/components/security/security.yml b/specification/api/components/security/security.yml
@@ -0,0 +1 @@
+$ref: security-dev-pr.yml
diff --git a/specification/api/components/x-nhsd-apim/access-dev-pr.yml b/specification/api/components/x-nhsd-apim/access-dev-pr.yml
@@ -0,0 +1,3 @@
+- title: Application Restricted
+  grants:
+    app-level0: []
diff --git a/specification/api/components/x-nhsd-apim/access-dev.yml b/specification/api/components/x-nhsd-apim/access-dev.yml
@@ -1,4 +1,3 @@
 - title: Application Restricted
   grants:
-    app-level0: []
     app-level3: []
diff --git a/specification/api/components/x-nhsd-apim/access.yml b/specification/api/components/x-nhsd-apim/access.yml
@@ -1 +1 @@
-$ref: access-sandbox.yml
+$ref: access-dev-pr.yml
diff --git a/specification/api/components/x-nhsd-apim/target-dev-pr.yml b/specification/api/components/x-nhsd-apim/target-dev-pr.yml
@@ -0,0 +1,7 @@
+type: external
+healthcheck: /_status
+url: https://suppliers.dev.nhsnotify.national.nhs.uk
+security:
+  type: apikey
+  header: Authorization
+  secret: nhs-notify-supplier-key
diff --git a/specification/api/components/x-nhsd-apim/target.yml b/specification/api/components/x-nhsd-apim/target.yml
@@ -1 +1 @@
-$ref: target-sandbox.yml
+$ref: target-dev-pr.yml
diff --git a/specification/api/notify-supplier-phase1.yml b/specification/api/notify-supplier-phase1.yml
@@ -8,7 +8,7 @@ info:
     This specification represents the in-development 'next' version of the API schema
     and should be treated as unstable.
 security:
-  - app-level0: [ ]
+  - $ref: 'components/security/security.yml'
 paths:
   /letters:
     parameters:
@@ -55,10 +55,11 @@ paths:
       $ref: 'components/endpoints/headDataId.yml'
 components:
   securitySchemes:
-    nhs-login-p0:
-      $ref: https://proxygen.ptl.api.platform.nhs.uk/components/securitySchemes/nhs-login-p0
+    app-level3:
+      $ref: https://proxygen.ptl.api.platform.nhs.uk/components/securitySchemes/app-level3
     app-level0:
       $ref: https://proxygen.ptl.api.platform.nhs.uk/components/securitySchemes/app-level0
+
 tags:
   - name: letter
     description: ''

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+- title: Application Restricted`
	`2`	`+ grants:`
	`3`	`+ app-level0: []`