Skip to content

Commit 87e0cb8

Browse files
ellie-bound1-NHSDellie-bound1-NHSD
committed
NPA-4599: Add 2 new flows for user and app restricted requests
1 parent 6509166 commit 87e0cb8

File tree

6 files changed

+86
-15
lines changed

6 files changed

+86
-15
lines changed

‎.flake8‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
11
[flake8]
22
max-line-length=120
3+
per-file-ignores=proxies/live/apiproxy/resources/*:F821
34
exclude = .git,__pycache__,dist,.venv/*,node_modules/*,utils/*,tests/.venv/*

‎proxies/live/apiproxy/policies/CheckAppEnabledEndpoint.xml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
2+
<Script async="false" continueOnError="false" enabled="true" name="CheckAppEnabledEndpoint">
3+
<DisplayName>CheckAppEnabledEndpoint</DisplayName>
4+
<Properties/>
5+
<ResourceURL>py://check-app-enabled-endpoint.py</ResourceURL>
6+
</Script>

‎proxies/live/apiproxy/policies/CheckUserEnabledEndpoint.xml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
2+
<Script async="false" continueOnError="false" enabled="true" name="CheckUserEnabledEndpoint">
3+
<DisplayName>CheckUserEnabledEndpoint</DisplayName>
4+
<Properties/>
5+
<ResourceURL>py://check-user-enabled-endpoint.py</ResourceURL>
6+
</Script>

‎proxies/live/apiproxy/resources/py/check-app-enabled-endpoint.py‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
path_suffix = flow.getVariable("proxy.pathsuffix")
2+
request_verb = flow.getVariable("request.verb")
3+
4+
requested_endpoint = (path_suffix, request_verb)
5+
6+
7+
auth_permitted = requested_endpoint in [("/FHIR/R4/Consent", "GET")]
8+
9+
flow.setVariable("app_auth_permitted", auth_permitted)

‎proxies/live/apiproxy/resources/py/user-enabled-endpoint.py‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
auth_level = flow.getVariable("accesstoken.auth_level")
2+
path_suffix = flow.getVariable("proxy.pathsuffix")
3+
request_verb = flow.getVariable("request.verb")
4+
5+
requested_endpoint = (path_suffix, request_verb)
6+
7+
if auth_level == "p9":
8+
auth_permitted = requested_endpoint in [
9+
("/FHIR/R4/RelatedPerson", "GET"),
10+
("/FHIR/R4/QuestionnaireResponse", "POST"),
11+
("/FHIR/R4/QuestionnaireResponse", "GET"),
12+
("/FHIR/R4/Consent", "GET"),
13+
("/FHIR/R4/Consent", "PATCH"),
14+
]
15+
elif auth_level == "all3":
16+
auth_permitted = requested_endpoint in [
17+
("/FHIR/R4/RelatedPerson", "GET"),
18+
("/FHIR/R4/Questionnaire", "GET"),
19+
("/FHIR/R4/QuestionnaireResponse", "GET"),
20+
("/FHIR/R4/Consent", "GET"),
21+
("/FHIR/R4/Consent", "POST"),
22+
("/FHIR/R4/Consent", "PATCH"),
23+
]
24+
else:
25+
auth_permitted = False
26+
27+
flow.setVariable("user_auth_permitted", auth_permitted)

‎proxies/live/apiproxy/targets/target.xml‎

Lines changed: 37 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -15,28 +15,50 @@
1515
<Name>AddProxyURL</Name>
1616
</Step>
1717
<Step>
18-
<Name>DecodeAccessTokenJWT</Name>
19-
</Step>
20-
<Step>
21-
<Name>AddUserAuthHeaders</Name>
22-
</Step>
23-
<Step>
24-
<Name>RaiseFault.403Forbidden</Name>
25-
<Condition>accesstoken.auth_level != "aal3" and proxy.pathsuffix = "/FHIR/R4/Consent" and request.verb = "POST"</Condition>
26-
</Step>
27-
<Step>
28-
<Name>RaiseFault.403Forbidden</Name>
29-
<Condition>accesstoken.auth_level != "p9" and (proxy.pathsuffix != "/FHIR/R4/Consent" or request.verb != "POST")</Condition>
18+
<Name>SetRequestAWSMimeType</Name>
3019
</Step>
3120
<Step>
3221
<Name>RaiseFault.415UnsupportedMediaType</Name>
3322
<Condition>request.verb = "POST" and request.header.Content-Type != "application/fhir+json" and request.header.Content-Type != "application/fhir+json; charset=utf-8"</Condition>
3423
</Step>
35-
<Step>
36-
<Name>SetRequestAWSMimeType</Name>
37-
</Step>
3824
</Request>
3925
</PreFlow>
26+
<Flows>
27+
<Flow name="App Restricted">
28+
<Request>
29+
<Step>
30+
<Name>CheckAppEnabledEndpoint</Name>
31+
</Step>
32+
<Step>
33+
<Name>RaiseFault.403Forbidden</Name>
34+
<Condition>app_auth_permitted != true</Condition>
35+
</Step>
36+
<Step>
37+
<Name>AddUserAuthHeaders</Name>
38+
</Step>
39+
</Request>
40+
<Condition>accesstoken.auth_type = "app"</Condition>
41+
</Flow>
42+
<Flow name ="User Restricted">
43+
<Request>
44+
<Step>
45+
<Name>CheckUserEnabledEndpoint</Name>
46+
</Step>
47+
<Step>
48+
<Name>RaiseFault.403Forbidden</Name>
49+
<Condition>user_auth_permitted != true</Condition>
50+
</Step>
51+
<Step>
52+
<Name>DecodeAccessTokenJWT</Name>
53+
</Step>
54+
<Step>
55+
<Name>AddUserAuthHeaders</Name>
56+
</Step>
57+
</Request>
58+
<Condition>accesstoken.auth_type = "user"</Condition>
59+
</Flow>
60+
</Flows>
61+
4062
<PostFlow>
4163
<Response>
4264
<Step>

0 commit comments

Comments
 (0)