adds EuoAllowListVerify functionality by kevinmason-nhs · Pull Request #2420 · NHSDigital/e-referrals-service-api

kevinmason-nhs · 2025-07-30T12:40:14Z

Summary

Adds new functionality for user-restricted flows to add EUOAllowlistVerify

This new functionality will check if the incoming ODS code is contained within the EUO allow list.

This should only be set if the Application has EUOAllowlistEnabled = true as a custom attribute.

Reviews Required

Dev
Test
Tech Author
Product Owner

Review Checklist

ℹ️ This section is to be filled in by the reviewer.

I have reviewed the changes in this PR and they fill all or part of the acceptance criteria of the ticket, and the code is in a mergeable state.
If there were infrastructure, operational, or build changes, I have made sure there is sufficient evidence that the changes will work.
I have ensured the changelog has been updated by the submitter, if necessary.

pca-nhs · 2025-08-29T14:59:56Z

/azp run

azure-pipelines · 2025-08-29T15:00:08Z

Azure Pipelines will not run the associated pipelines, because the pull request was updated after the run command was issued. Review the pull request again and issue a new run command.

pca-nhs · 2025-09-09T09:50:37Z

+                <Condition>(accesstoken.auth_type == "user")</Condition>
+            </Step>
            <Step>
                <Name>RaiseFault.MissingAsid</Name>


CGI Feedback: Keep in mind the step order and the error being returned -- you only get one error, so priorities the error you want the user to see first

do we want the asid validation to come before this?

I think we can go both ways: if the partner ASID is missing, we could surface that error, but if possibly the verification logic is more specific, so we'd be going from that to the (possibly) more broader error or the partner ASID being missing in the request. The key point I think is that we'd terminate early, so a request with both issues won't progress until the first is resolved

pca-nhs · 2025-09-11T13:24:33Z

@@ -0,0 +1,18 @@
+<AssignMessage enabled="true" name="AssignMessage.SetOperationOutcomeODSHeaderMissingPreR4">


Given the change/refactor, we're duplicating the context between PreR4/R4 -- argument for collapsing this in the technical debt ticket

pca-nhs

LGTM

…ion to use new business functions]-[JW]

kevinmason-nhs

LGTM

kevinmason-nhs requested a review from a team as a code owner July 30, 2025 12:40

kevinmason-nhs commented Sep 9, 2025

View reviewed changes

Comment thread tests/integration/test_headers.py Outdated

kevinmason-nhs commented Sep 9, 2025

View reviewed changes

Comment thread specification/components/r4/schemas/endpoints/a042-retrieve-attachment.yaml

kevinmason-nhs commented Sep 9, 2025

View reviewed changes

Comment thread proxies/live/apiproxy/targets/ers-target.xml

kevinmason-nhs commented Sep 9, 2025

View reviewed changes

Comment thread proxies/live/apiproxy/targets/ers-target.xml

kevinmason-nhs commented Sep 9, 2025

View reviewed changes

Comment thread proxies/live/apiproxy/targets/ers-target.xml

kevinmason-nhs commented Sep 9, 2025

View reviewed changes

Comment thread proxies/live/apiproxy/targets/ers-target.xml

kevinmason-nhs commented Sep 9, 2025

View reviewed changes

Comment thread proxies/live/apiproxy/proxies/default.xml

kevinmason-nhs commented Sep 9, 2025

View reviewed changes

Comment thread proxies/live/apiproxy/proxies/default.xml

kevinmason-nhs commented Sep 9, 2025

View reviewed changes

Comment thread proxies/live/apiproxy/proxies/default.xml

pca-nhs reviewed Sep 9, 2025

View reviewed changes

Comment thread manifest_template.yml Outdated

pca-nhs reviewed Sep 9, 2025

View reviewed changes

Comment thread manifest_template.yml

pca-nhs reviewed Sep 9, 2025

View reviewed changes

Comment thread proxies/live/apiproxy/targets/ers-target.xml Outdated

pca-nhs reviewed Sep 9, 2025

View reviewed changes

Comment thread proxies/live/apiproxy/targets/ers-target.xml Outdated

pca-nhs reviewed Sep 9, 2025

View reviewed changes

Comment thread proxies/live/apiproxy/policies/AssignMessage.SetOperationOutcomeODSHeaderMissingR4.xml Outdated

pca-nhs reviewed Sep 9, 2025

View reviewed changes

Comment thread proxies/live/apiproxy/targets/ers-target.xml Outdated

pca-nhs reviewed Sep 9, 2025

View reviewed changes

Comment thread proxies/live/apiproxy/targets/ers-target.xml Outdated

pca-nhs reviewed Sep 9, 2025

View reviewed changes

Comment thread tests/conftest.py Outdated

kevinmason-nhs commented Sep 9, 2025

View reviewed changes

Comment thread proxies/live/apiproxy/policies/AssignMessage.SetOperationOutcomeVariablesR4.xml

kevinmason-nhs force-pushed the feature/ERSSUP-86798 branch from a50ffff to 44ed7ff Compare September 11, 2025 08:50

pca-nhs reviewed Sep 11, 2025

View reviewed changes

pca-nhs previously approved these changes Sep 11, 2025

View reviewed changes

pca-nhs reviewed Sep 12, 2025

View reviewed changes

Comment thread ...e/apiproxy/policies/AssignMessage.SetOperationOutcomeODSHeaderValueNotInPartnerListPreR4.xml Outdated

pca-nhs reviewed Sep 12, 2025

View reviewed changes

Comment thread ...live/apiproxy/policies/AssignMessage.SetOperationOutcomeODSHeaderValueNotInPartnerListR4.xml Outdated

pca-nhs reviewed Sep 12, 2025

View reviewed changes

Comment thread proxies/live/apiproxy/policies/AssignMessage.SetOperationOutcomeODSHeaderMissingR4.xml Outdated

pca-nhs reviewed Sep 12, 2025

View reviewed changes

Comment thread proxies/live/apiproxy/policies/AssignMessage.SetOperationOutcomeODSHeaderMissingPreR4.xml Outdated

pca-nhs dismissed their stale review via ee89b99 September 12, 2025 10:20

pca-nhs force-pushed the feature/ERSSUP-86798 branch 3 times, most recently from 00f8926 to 13a705d Compare September 12, 2025 11:24

pca-nhs force-pushed the feature/ERSSUP-86798 branch from 1a7ded6 to f2ab1ba Compare September 23, 2025 17:48

pca-nhs requested review from adamoldfield-nhs, daniel-mcadam-nhs, nhsd-andrew-tuley, nhsd-dm, nhsd-jack-wainwright, nhsd-sw and sudhanshu-arya1 as code owners September 23, 2025 17:48

pca-nhs force-pushed the feature/ERSSUP-86798 branch from f2ab1ba to 2cbc884 Compare September 23, 2025 17:55

kevinmason-nhs and others added 5 commits September 24, 2025 12:22

[ERSSUP-86798]-[PC]-[Add ODS APIGEE validation]-[KM]

7de573a

[ERSSUP-89806]-[MW]-[Updated app-restricted business function validat…

a52030b

…ion to use new business functions]-[JW]

Update resourceType

6944e42

restore

7edac83

fix

7803c89

pca-nhs force-pushed the feature/ERSSUP-86798 branch from 44dd84c to 7803c89 Compare September 24, 2025 12:26

fix

2110761

pca-nhs self-requested a review September 24, 2025 14:21

kevinmason-nhs commented Sep 24, 2025

View reviewed changes

pca-nhs approved these changes Sep 24, 2025

View reviewed changes

pca-nhs merged commit af29235 into develop Sep 24, 2025
4 checks passed

		@@ -0,0 +1,18 @@
		<AssignMessage enabled="true" name="AssignMessage.SetOperationOutcomeODSHeaderMissingPreR4">

Conversation

kevinmason-nhs commented Jul 30, 2025

Summary

Reviews Required

Review Checklist

Uh oh!

pca-nhs commented Aug 29, 2025

Uh oh!

azure-pipelines Bot commented Aug 29, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

pca-nhs Sep 9, 2025

Choose a reason for hiding this comment

Uh oh!

kevinmason-nhs Sep 11, 2025

Choose a reason for hiding this comment

Uh oh!

pca-nhs Sep 11, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

pca-nhs Sep 11, 2025

Choose a reason for hiding this comment

Uh oh!

pca-nhs left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kevinmason-nhs left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants