SIMSBIOHUB 866: Submitting a Data Request (#353)

* feat: adds record_end_date when creating a policy with an expiration date

* feat: creates a policy for the team that made the data request

* test: data request service

* refact: adds private methods to handle responsibilities of creating a data request

* feat: adds custom hooks for calling the api to create a data request

* feat: adds /request-access client-side route

* feat: adds util to determine if any search results are secure

* feat: renders banner if any search results are secure

* feat: add RequestDataPage with form

* cleanup

* cleanup

* refact: extracts AlertBanner to reusable component

* cleanup

* refact: uses dialogContext to display errors

* misc

* refact(minor): updates api docs for findDataRequests endpoint

* cleanup

* refact: DataRequestService

* refact: removes redundant defualt prop

* refact: extracts interfaces to their own file

* refact: adds DataRequestRouter

* refact: renames to 'data request'

* fix: tests for createDataRequest

* refact: removes util for hasSecuredResults

* refact: params for createTeamPolicy

* misc

---------

Co-authored-by: Macgregor Aubertin-Young <108430771+mauberti-bc@users.noreply.github.com>

Author: J-pilon

api/src/models/data-request.ts

@@ -19,6 +19,7 @@ export const DataRequestFilters = z.object({
 export type DataRequestFilters = z.infer<typeof DataRequestFilters>;
 
 export const CreateDataRequest = z.object({
+  requested_by: z.number().int(),
   reason: z.string(),
   team_id: z.string().uuid().optional()
 });
@@ -29,9 +30,10 @@ export const UpdateDataRequest = z.object({
 });
 export type UpdateDataRequest = z.infer<typeof UpdateDataRequest>;
 
-// ──────────────────────────────────────────────────────────────────────────────
-// data_request CRUD Responses
-// ──────────────────────────────────────────────────────────────────────────────
+export interface CreateTeamPolicyParams {
+  teamId: string;
+  policyId: string;
+}
 
 export const FlatDataRequestWithStatus = DataRequest.extend(DataRequestStatus.shape);
 export type FlatDataRequestWithStatus = z.infer<typeof FlatDataRequestWithStatus>;

api/src/models/policy.ts

@@ -13,6 +13,7 @@ export type Policy = z.infer<typeof Policy>;
 export interface CreatePolicy {
   name: string;
   description?: string;
+  record_end_date?: string;
 }
 
 export interface UpdatePolicy {

api/src/paths/data-request/index.test.ts

@@ -221,7 +221,8 @@ describe('data-request', () => {
 
       await requestHandler(mockReq, mockRes, mockNext);
 
-      expect(stub).to.have.been.calledOnceWith(mockDBConnection.systemUserId(), {
+      expect(stub).to.have.been.calledOnceWith({
+        requested_by: mockDBConnection.systemUserId(),
         reason: 'Research purposes',
         team_id: mockDataRequestWithStatus.team_id
       });
@@ -248,7 +249,8 @@ describe('data-request', () => {
 
       await requestHandler(mockReq, mockRes, mockNext);
 
-      expect(stub).to.have.been.calledOnceWith(mockDBConnection.systemUserId(), {
+      expect(stub).to.have.been.calledOnceWith({
+        requested_by: mockDBConnection.systemUserId(),
         reason: 'Research purposes',
         team_id: undefined
       });

api/src/paths/data-request/index.ts

@@ -40,7 +40,8 @@ export const POST: Operation = [
 ];
 
 GET.apiDoc = {
-  description: 'Find all data request records, optionally filtered by date range, requested_by, team_id, or status',
+  description:
+    'Find data request records for teams the current user belongs to, optionally filtered by date range, requested_by, team_id, or status',
   tags: ['data-request'],
   security: [
     {
@@ -125,7 +126,7 @@ POST.apiDoc = {
 };
 
 /**
- * Find all data request records, optionally filtered by query params.
+ * Find data request records for teams the current user belongs to, optionally filtered by query params.
  *
  * @returns {RequestHandler}
  */
@@ -172,7 +173,11 @@ export function createDataRequest(): RequestHandler {
 
       const dataRequestService = new DataRequestService(connection);
 
-      const dataRequest = await dataRequestService.createDataRequest(systemUserId, { reason, team_id: teamId });
+      const dataRequest = await dataRequestService.createDataRequest({
+        requested_by: systemUserId,
+        reason,
+        team_id: teamId
+      });
 
       await connection.commit();
 

api/src/repositories/authorization/policy-repository.ts

@@ -32,7 +32,8 @@ export class PolicyRepository extends BaseRepository {
       .table('policy')
       .insert({
         name: policyData.name,
-        description: policyData.description
+        description: policyData.description,
+        record_end_date: policyData.record_end_date
       })
       .returning(['policy_id', 'name', 'description']);
 
@@ -147,7 +148,7 @@ export class PolicyRepository extends BaseRepository {
       INNER JOIN policy_urn_parts ps 
         ON ps.policy_id = p.policy_id
       WHERE tm.system_user_id = ${systemUserId}
-        AND p.record_end_date IS NULL
+        AND (p.record_end_date IS NULL OR p.record_end_date > NOW())
         AND (ps.part1 = ${urnParts.submissionId} OR ps.part1 = '*')
         AND (ps.part2 = ${urnParts.featureTypeName} OR ps.part2 = '*')
         AND (ps.part3 = ${urnParts.submissionFeatureId} OR ps.part3 = '*')

api/src/repositories/data-request-repository.test.ts

@@ -239,7 +239,10 @@ describe('DataRequestRepository', () => {
 
       const repo = new DataRequestRepository(mockDBConnection);
 
-      const payload: CreateDataRequest = { reason: 'New research project' };
+      const payload: CreateDataRequest = {
+        requested_by: mockDataRequest.requested_by,
+        reason: 'New research project'
+      };
 
       const result = await repo.createDataRequest(mockDataRequest.requested_by, payload);
 
@@ -258,7 +261,10 @@ describe('DataRequestRepository', () => {
 
       const repo = new DataRequestRepository(mockDBConnection);
 
-      const payload: CreateDataRequest = { reason: 'Test' };
+      const payload: CreateDataRequest = {
+        requested_by: mockDataRequest.requested_by,
+        reason: 'Test'
+      };
 
       try {
         await repo.createDataRequest(mockDataRequest.requested_by, payload);

api/src/services/data-request-service.test.ts

@@ -4,10 +4,13 @@ import sinon from 'sinon';
 import sinonChai from 'sinon-chai';
 import { CreateDataRequest, DataRequest, FlatDataRequestWithStatus, UpdateDataRequest } from '../models/data-request';
 import { DataRequestStatus, DataRequestStatusEnum } from '../models/data-request-status';
+import { PolicyEffect } from '../models/policy-statement';
 import { TeamMemberWithUser } from '../models/team-member';
 import { DataRequestRepository } from '../repositories/data-request-repository';
 import { getMockDBConnection } from '../__mocks__/db';
+import { PolicyService } from './access-policy/policy-service';
 import { TeamMemberService } from './access-policy/team-member-service';
+import { TeamPolicyService } from './access-policy/team-policy-service';
 import { TeamService } from './access-policy/team-service';
 import { DataRequestService } from './data-request-service';
 import { DataRequestStatusService } from './data-request-status-service';
@@ -197,62 +200,132 @@ describe('DataRequestService', () => {
   });
 
   describe('createDataRequest', () => {
-    it('should create a data request with provided team_id and return it with status', async () => {
+    const mockApprovedStatus: DataRequestStatus = {
+      ...mockDataRequestStatus,
+      request_status: 'APPROVED'
+    };
+
+    const mockPolicy = {
+      policy_id: 'f6a7b8c9-d0e1-2345-fabc-456789012345',
+      name: 'Data request policy - uuid',
+      description: null,
+      statements: []
+    };
+
+    const mockTeamPolicy = {
+      team_policy_id: '12345678-abcd-ef01-2345-678901234567',
+      team_id: mockDataRequest.team_id,
+      policy_id: mockPolicy.policy_id
+    };
+
+    const stubCreateDataRequestDependencies = (
+      overrides: {
+        teamId?: string;
+        createNewTeam?: boolean;
+      } = {}
+    ) => {
+      const { teamId = mockDataRequest.team_id, createNewTeam = false } = overrides;
+
+      if (createNewTeam) {
+        sinon
+          .stub(TeamService.prototype, 'createTeam')
+          .resolves({ team_id: teamId, name: 'test', description: null, member_count: 1 });
+        sinon.stub(TeamMemberService.prototype, 'createTeamMember').resolves(mockTeamMember);
+      }
+
+      sinon
+        .stub(DataRequestRepository.prototype, 'createDataRequest')
+        .resolves({ ...mockDataRequest, team_id: teamId });
+      sinon.stub(PolicyService.prototype, 'createPolicyWithStatements').resolves(mockPolicy);
+      sinon.stub(TeamPolicyService.prototype, 'createTeamPolicy').resolves({ ...mockTeamPolicy, team_id: teamId });
+      sinon.stub(DataRequestStatusService.prototype, 'createDataRequestStatus').resolves(mockApprovedStatus);
+    };
+
+    it('should create a data request with provided team_id, create a policy, and auto-approve', async () => {
       const mockDB = getMockDBConnection();
       const service = new DataRequestService(mockDB);
 
-      const payload: CreateDataRequest = { reason: 'New research project', team_id: mockDataRequest.team_id };
-      const createStub = sinon.stub(DataRequestRepository.prototype, 'createDataRequest').resolves(mockDataRequest);
-      const statusStub = sinon
-        .stub(DataRequestStatusService.prototype, 'createDataRequestStatus')
-        .resolves(mockDataRequestStatus);
+      const payload: CreateDataRequest = {
+        requested_by: mockDataRequest.requested_by,
+        reason: 'New research project',
+        team_id: mockDataRequest.team_id
+      };
+
+      stubCreateDataRequestDependencies();
+
+      const createStub = DataRequestRepository.prototype.createDataRequest as sinon.SinonStub;
+      const policyStub = PolicyService.prototype.createPolicyWithStatements as sinon.SinonStub;
+      const teamPolicyStub = TeamPolicyService.prototype.createTeamPolicy as sinon.SinonStub;
+      const statusStub = DataRequestStatusService.prototype.createDataRequestStatus as sinon.SinonStub;
+
+      const result = await service.createDataRequest(payload);
+
+      expect(createStub).to.have.been.calledOnceWith(mockDataRequest.requested_by, {
+        ...payload,
+        team_id: mockDataRequest.team_id
+      });
+
+      expect(policyStub).to.have.been.calledOnce;
+      const policyArgs = policyStub.firstCall.args;
+      expect(policyArgs[1]).to.deep.equal([{ effect: PolicyEffect.ALLOW, submission_feature_urn: 'urn:*:*:*' }]);
+      expect(policyArgs[0]).to.have.property('record_end_date').that.is.a('string');
 
-      const result = await service.createDataRequest(mockDataRequest.requested_by, payload);
+      expect(teamPolicyStub).to.have.been.calledOnceWith({
+        team_id: mockDataRequest.team_id,
+        policy_id: mockPolicy.policy_id
+      });
 
-      expect(createStub).to.have.been.calledOnceWith(mockDataRequest.requested_by, payload);
       expect(statusStub).to.have.been.calledOnceWith(
         mockDataRequest.data_request_id,
-        DataRequestStatusEnum.enum.REQUESTED,
+        DataRequestStatusEnum.enum.APPROVED,
         undefined
       );
+
       expect(result.data_request_id).to.equal(mockDataRequest.data_request_id);
-      expect(result.data_request_status).to.deep.equal(mockDataRequestStatus);
+      expect(result.data_request_status.request_status).to.equal('APPROVED');
     });
 
     it('should create a new team when payload.team_id is undefined', async () => {
       const mockDB = getMockDBConnection();
       const service = new DataRequestService(mockDB);
 
       const newTeamId = 'e5f6a7b8-c9d0-1234-efab-345678901234';
-      const teamStub = sinon
-        .stub(TeamService.prototype, 'createTeam')
-        .resolves({ team_id: newTeamId, name: 'test', description: null, member_count: 0 });
-      const memberStub = sinon.stub(TeamMemberService.prototype, 'createTeamMember').resolves(mockTeamMember);
-      sinon.stub(DataRequestRepository.prototype, 'createDataRequest').resolves({
-        ...mockDataRequest,
-        team_id: newTeamId
-      });
-      sinon.stub(DataRequestStatusService.prototype, 'createDataRequestStatus').resolves(mockDataRequestStatus);
+      stubCreateDataRequestDependencies({ teamId: newTeamId, createNewTeam: true });
 
-      const payload: CreateDataRequest = { reason: 'New research project' };
-      await service.createDataRequest(mockDataRequest.requested_by, payload);
+      const teamStub = TeamService.prototype.createTeam as sinon.SinonStub;
+      const memberStub = TeamMemberService.prototype.createTeamMember as sinon.SinonStub;
+      const teamPolicyStub = TeamPolicyService.prototype.createTeamPolicy as sinon.SinonStub;
+
+      const payload: CreateDataRequest = {
+        requested_by: mockDataRequest.requested_by,
+        reason: 'New research project'
+      };
+      await service.createDataRequest(payload);
 
       expect(teamStub).to.have.been.calledOnce;
       expect(memberStub).to.have.been.calledOnceWith({
         system_user_id: mockDataRequest.requested_by,
         team_id: newTeamId
       });
+      expect(teamPolicyStub).to.have.been.calledOnceWith({
+        team_id: newTeamId,
+        policy_id: mockPolicy.policy_id
+      });
     });
 
     it('should propagate repository errors', async () => {
       const mockDB = getMockDBConnection();
       const service = new DataRequestService(mockDB);
 
-      const payload: CreateDataRequest = { reason: 'Test', team_id: mockDataRequest.team_id };
+      const payload: CreateDataRequest = {
+        requested_by: 1,
+        reason: 'Test',
+        team_id: mockDataRequest.team_id
+      };
       sinon.stub(DataRequestRepository.prototype, 'createDataRequest').rejects(new Error('DB error'));
 
       try {
-        await service.createDataRequest(1, payload);
+        await service.createDataRequest(payload);
         throw new Error('Expected to throw');
       } catch (err) {
         expect(err).to.be.instanceOf(Error);