Skip to content

Commit 9db13dc

Browse files
EdwardWills-nhsEdwardWills-nhs
committed
Remove EUO allowlist tests and apim_app_flow_vars references
1 parent dd73c2e commit 9db13dc

1 file changed

Lines changed: 5 additions & 218 deletions

File tree

‎tests/integration/test_user_restricted.py‎

Lines changed: 5 additions & 218 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,6 @@
11
import pytest
22
import requests
3-
from requests import Response
4-
from tests.data import RenamedHeader, Actor, UserAuthenticationLevel
5-
from tests.asserts import assert_ok_response
3+
from tests.data import RenamedHeader, Actor
64

75
_HEADER_AUTHORIZATION = "Authorization"
86
_HEADER_ECHO = "echo" # enable echo target
@@ -32,11 +30,11 @@ class TestUserRestricted:
3230

3331
@pytest.mark.asyncio
3432
@pytest.mark.parametrize(
35-
"endpoint_url, is_fhir_4, user, apim_app_flow_vars ",
33+
"endpoint_url, is_fhir_4, user",
3634
[
37-
("", False, Actor.RC_DEV, [Actor.RC_DEV.org_code]),
38-
("/FHIR/R4/", True, Actor.RC_DEV, [Actor.RC_DEV.org_code]),
39-
("/FHIR/STU3/", False, Actor.RC_DEV, [Actor.RC_DEV.org_code]),
35+
("", False, Actor.RC_DEV),
36+
("/FHIR/R4/", True, Actor.RC_DEV),
37+
("/FHIR/STU3/", False, Actor.RC_DEV),
4038
],
4139
)
4240
async def test_user_restricted_valid_ods_code(
@@ -47,7 +45,6 @@ async def test_user_restricted_valid_ods_code(
4745
asid,
4846
endpoint_url,
4947
is_fhir_4,
50-
apim_app_flow_vars,
5148
):
5249
access_code = await authenticate_user(user)
5350

@@ -73,213 +70,3 @@ async def test_user_restricted_valid_ods_code(
7370
assert (
7471
response.status_code == 200
7572
), "Expected a 200 when accessing the api but got " + str(response.status_code)
76-
77-
@pytest.mark.asyncio
78-
@pytest.mark.parametrize(
79-
"endpoint_url, is_fhir_4, user ,apim_app_flow_vars",
80-
[
81-
("", False, Actor.RC_DEV, ["invalid_code"]),
82-
("/FHIR/R4/", True, Actor.RC_DEV, ["invalid_code"]),
83-
("/FHIR/STU3/", False, Actor.RC_DEV, ["invalid_code"]),
84-
],
85-
)
86-
async def test_user_restricted_invalid_ods_code(
87-
self,
88-
authenticate_user,
89-
service_url,
90-
user: Actor,
91-
asid,
92-
endpoint_url,
93-
is_fhir_4,
94-
apim_app_flow_vars,
95-
):
96-
access_code = await authenticate_user(user)
97-
98-
client_request_headers = {
99-
_HEADER_ECHO: "", # enable echo target
100-
_HEADER_AUTHORIZATION: "Bearer " + access_code,
101-
_HEADER_REQUEST_ID: "DUMMY-VALUE",
102-
RenamedHeader.REFERRAL_ID.original: _EXPECTED_REFERRAL_ID,
103-
RenamedHeader.CORRELATION_ID.original: _EXPECTED_CORRELATION_ID,
104-
RenamedHeader.BUSINESS_FUNCTION.original: user.business_function,
105-
RenamedHeader.ODS_CODE.original: user.org_code,
106-
RenamedHeader.FILENAME.original: _EXPECTED_FILENAME,
107-
RenamedHeader.COMM_RULE_ORG.original: _EXPECTED_COMM_RULE_ORG,
108-
RenamedHeader.OBO_USER_ID.original: _EXPECTED_OBO_USER_ID,
109-
}
110-
111-
# Make the API call
112-
response = requests.get(
113-
f"{service_url}{endpoint_url}", headers=client_request_headers
114-
)
115-
# Verify the status
116-
assert (
117-
response.status_code == 403
118-
), "Expected a 403 when accessing the api but got " + str(response.status_code)
119-
# Verify the OperationOutcome payload
120-
response_data = response.json()
121-
assert response_data["resourceType"] == "OperationOutcome"
122-
assert response_data["meta"]["lastUpdated"] is not None
123-
assert len(response_data["meta"]["profile"]) == 1
124-
assert response_data["meta"]["profile"][0] == (
125-
"https://www.hl7.org/fhir/R4/operationoutcome.html"
126-
if is_fhir_4
127-
else "https://fhir.nhs.uk/STU3/StructureDefinition/eRS-OperationOutcome-1"
128-
)
129-
assert len(response_data["issue"]) == 1
130-
issue = response_data["issue"][0]
131-
assert issue["severity"] == "error"
132-
assert issue["code"] == "forbidden" if is_fhir_4 else "forbidden"
133-
assert issue["diagnostics"] == (
134-
"Unauthorised ODS code provided in NHSD-End-User-Organisation-ODS header"
135-
)
136-
assert len(issue["details"]["coding"]) == 1
137-
issue_details = issue["details"]["coding"][0]
138-
assert (
139-
issue_details["system"]
140-
== "https://fhir.nhs.uk/CodeSystem/NHSD-API-ErrorOrWarningCode"
141-
if is_fhir_4
142-
else "https://fhir.nhs.uk/STU3/CodeSystem/eRS-APIErrorCode-1"
143-
)
144-
assert issue_details["code"] == "ACCESS_DENIED" if is_fhir_4 else "NO_ACCESS"
145-
146-
@pytest.mark.asyncio
147-
@pytest.mark.parametrize(
148-
"endpoint_url, is_fhir_4, user ,apim_app_flow_vars",
149-
[
150-
("", False, Actor.RC_DEV, [Actor.RC_DEV.org_code]),
151-
("/FHIR/R4/", True, Actor.RC_DEV, [Actor.RC_DEV.org_code]),
152-
("/FHIR/STU3/", False, Actor.RC_DEV, [Actor.RC_DEV.org_code]),
153-
],
154-
)
155-
async def test_user_restricted_missing_ods_header(
156-
self,
157-
authenticate_user,
158-
service_url,
159-
user: Actor,
160-
asid,
161-
endpoint_url,
162-
is_fhir_4,
163-
apim_app_flow_vars,
164-
):
165-
access_code = await authenticate_user(user)
166-
167-
client_request_headers = {
168-
_HEADER_ECHO: "", # enable echo target
169-
_HEADER_AUTHORIZATION: "Bearer " + access_code,
170-
_HEADER_REQUEST_ID: "DUMMY-VALUE",
171-
RenamedHeader.REFERRAL_ID.original: _EXPECTED_REFERRAL_ID,
172-
RenamedHeader.CORRELATION_ID.original: _EXPECTED_CORRELATION_ID,
173-
RenamedHeader.BUSINESS_FUNCTION.original: user.business_function,
174-
RenamedHeader.FILENAME.original: _EXPECTED_FILENAME,
175-
RenamedHeader.COMM_RULE_ORG.original: _EXPECTED_COMM_RULE_ORG,
176-
RenamedHeader.OBO_USER_ID.original: _EXPECTED_OBO_USER_ID,
177-
}
178-
179-
# Make the API call
180-
response = requests.get(
181-
f"{service_url}{endpoint_url}", headers=client_request_headers
182-
)
183-
# Verify the status
184-
assert (
185-
response.status_code == 400
186-
), "Expected a 400 when accessing the api but got " + str(response.status_code)
187-
# Verify the OperationOutcome payload
188-
response_data = response.json()
189-
assert response_data["resourceType"] == "OperationOutcome"
190-
assert response_data["meta"]["lastUpdated"] is not None
191-
assert len(response_data["meta"]["profile"]) == 1
192-
assert response_data["meta"]["profile"][0] == (
193-
"https://www.hl7.org/fhir/R4/operationoutcome.html"
194-
if is_fhir_4
195-
else "https://fhir.nhs.uk/STU3/StructureDefinition/eRS-OperationOutcome-1"
196-
)
197-
assert len(response_data["issue"]) == 1
198-
issue = response_data["issue"][0]
199-
assert issue["severity"] == "error"
200-
assert issue["code"] == "required" if is_fhir_4 else "required"
201-
assert issue["diagnostics"] == (
202-
"Missing or Empty NHSD-End-User-Organisation-ODS header."
203-
)
204-
assert len(issue["details"]["coding"]) == 1
205-
issue_details = issue["details"]["coding"][0]
206-
assert (
207-
issue_details["system"]
208-
== "https://fhir.nhs.uk/CodeSystem/NHSD-API-ErrorOrWarningCode"
209-
if is_fhir_4
210-
else "https://fhir.nhs.uk/STU3/CodeSystem/eRS-APIErrorCode-1"
211-
)
212-
assert (
213-
issue_details["code"] == "MISSING_HEADER" if is_fhir_4 else "MISSING_HEADER"
214-
)
215-
216-
@pytest.mark.asyncio
217-
@pytest.mark.parametrize(
218-
"endpoint_url, is_fhir_4, user ,apim_app_flow_vars",
219-
[
220-
("", False, Actor.RC_DEV, [Actor.RC_DEV.org_code]),
221-
("/FHIR/R4/", True, Actor.RC_DEV, [Actor.RC_DEV.org_code]),
222-
("/FHIR/STU3/", False, Actor.RC_DEV, [Actor.RC_DEV.org_code]),
223-
],
224-
)
225-
async def test_user_restricted_missing_ods_code(
226-
self,
227-
authenticate_user,
228-
service_url,
229-
user: Actor,
230-
asid,
231-
endpoint_url,
232-
is_fhir_4,
233-
apim_app_flow_vars,
234-
):
235-
access_code = await authenticate_user(user)
236-
237-
client_request_headers = {
238-
_HEADER_ECHO: "", # enable echo target
239-
_HEADER_AUTHORIZATION: "Bearer " + access_code,
240-
_HEADER_REQUEST_ID: "DUMMY-VALUE",
241-
RenamedHeader.REFERRAL_ID.original: _EXPECTED_REFERRAL_ID,
242-
RenamedHeader.CORRELATION_ID.original: _EXPECTED_CORRELATION_ID,
243-
RenamedHeader.BUSINESS_FUNCTION.original: user.business_function,
244-
RenamedHeader.ODS_CODE.original: "",
245-
RenamedHeader.FILENAME.original: _EXPECTED_FILENAME,
246-
RenamedHeader.COMM_RULE_ORG.original: _EXPECTED_COMM_RULE_ORG,
247-
RenamedHeader.OBO_USER_ID.original: _EXPECTED_OBO_USER_ID,
248-
}
249-
250-
# Make the API call
251-
response = requests.get(
252-
f"{service_url}{endpoint_url}", headers=client_request_headers
253-
)
254-
# Verify the status
255-
assert (
256-
response.status_code == 400
257-
), "Expected a 400 when accessing the api but got " + str(response.status_code)
258-
# Verify the OperationOutcome payload
259-
response_data = response.json()
260-
assert response_data["resourceType"] == "OperationOutcome"
261-
assert response_data["meta"]["lastUpdated"] is not None
262-
assert len(response_data["meta"]["profile"]) == 1
263-
assert response_data["meta"]["profile"][0] == (
264-
"https://www.hl7.org/fhir/R4/operationoutcome.html"
265-
if is_fhir_4
266-
else "https://fhir.nhs.uk/STU3/StructureDefinition/eRS-OperationOutcome-1"
267-
)
268-
assert len(response_data["issue"]) == 1
269-
issue = response_data["issue"][0]
270-
assert issue["severity"] == "error"
271-
assert issue["code"] == "required" if is_fhir_4 else "required"
272-
assert issue["diagnostics"] == (
273-
"Missing or Empty NHSD-End-User-Organisation-ODS header."
274-
)
275-
assert len(issue["details"]["coding"]) == 1
276-
issue_details = issue["details"]["coding"][0]
277-
assert (
278-
issue_details["system"]
279-
== "https://fhir.nhs.uk/CodeSystem/NHSD-API-ErrorOrWarningCode"
280-
if is_fhir_4
281-
else "https://fhir.nhs.uk/STU3/CodeSystem/eRS-APIErrorCode-1"
282-
)
283-
assert (
284-
issue_details["code"] == "MISSING_HEADER" if is_fhir_4 else "MISSING_HEADER"
285-
)

0 commit comments

Comments
 (0)