Skip to content

Commit 754b6a3

Browse files
shweta-nhsshweta-nhs
authored
ELI-404: Fix Error message returned for authorisation failure (#289)
* ELI-404: Fix Error message returned for authorisation failure * ELI-404: Fix sonar
1 parent dca12d8 commit 754b6a3

4 files changed

Lines changed: 17 additions & 26 deletions

File tree

‎src/eligibility_signposting_api/common/api_error_response.py‎

Lines changed: 5 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -26,27 +26,26 @@ class FHIRIssueCode(str, Enum):
2626

2727

2828
class FHIRSpineErrorCode(str, Enum):
29-
INVALID_NHS_NUMBER = "INVALID_NHS_NUMBER"
29+
ACCESS_DENIED = "ACCESS_DENIED"
3030
INVALID_PARAMETER = "INVALID_PARAMETER"
3131
BAD_REQUEST = "BAD_REQUEST"
3232
INTERNAL_SERVER_ERROR = "INTERNAL_SERVER_ERROR"
3333
REFERENCE_NOT_FOUND = "REFERENCE_NOT_FOUND"
3434

3535

3636
class APIErrorResponse:
37-
def __init__( # noqa: PLR0913
37+
def __init__(
3838
self,
3939
status_code: HTTPStatus,
4040
fhir_issue_code: FHIRIssueCode,
4141
fhir_issue_severity: FHIRIssueSeverity,
42-
fhir_coding_system: str,
4342
fhir_error_code: str,
4443
fhir_display_message: str,
4544
) -> None:
4645
self.status_code = status_code
4746
self.fhir_issue_code = fhir_issue_code
4847
self.fhir_issue_severity = fhir_issue_severity
49-
self.fhir_coding_system = fhir_coding_system
48+
self.fhir_coding_system = "https://fhir.nhs.uk/STU3/ValueSet/Spine-ErrorOrWarningCode-1"
5049
self.fhir_error_code = fhir_error_code
5150
self.fhir_display_message = fhir_display_message
5251

@@ -96,7 +95,6 @@ def log_and_generate_response(
9695
status_code=HTTPStatus.UNPROCESSABLE_ENTITY,
9796
fhir_issue_code=FHIRIssueCode.VALUE,
9897
fhir_issue_severity=FHIRIssueSeverity.ERROR,
99-
fhir_coding_system="https://fhir.nhs.uk/STU3/ValueSet/Spine-ErrorOrWarningCode-1",
10098
fhir_error_code=FHIRSpineErrorCode.INVALID_PARAMETER,
10199
fhir_display_message="The supplied value was not recognised by the API.",
102100
)
@@ -105,7 +103,6 @@ def log_and_generate_response(
105103
status_code=HTTPStatus.UNPROCESSABLE_ENTITY,
106104
fhir_issue_code=FHIRIssueCode.VALUE,
107105
fhir_issue_severity=FHIRIssueSeverity.ERROR,
108-
fhir_coding_system="https://fhir.nhs.uk/STU3/ValueSet/Spine-ErrorOrWarningCode-1",
109106
fhir_error_code=FHIRSpineErrorCode.INVALID_PARAMETER,
110107
fhir_display_message="The supplied category was not recognised by the API.",
111108
)
@@ -114,7 +111,6 @@ def log_and_generate_response(
114111
status_code=HTTPStatus.BAD_REQUEST,
115112
fhir_issue_code=FHIRIssueCode.VALUE,
116113
fhir_issue_severity=FHIRIssueSeverity.ERROR,
117-
fhir_coding_system="https://fhir.nhs.uk/STU3/ValueSet/Spine-ErrorOrWarningCode-1",
118114
fhir_error_code=FHIRSpineErrorCode.INVALID_PARAMETER,
119115
fhir_display_message="The given conditions were not in the expected format.",
120116
)
@@ -123,7 +119,6 @@ def log_and_generate_response(
123119
status_code=HTTPStatus.NOT_FOUND,
124120
fhir_issue_code=FHIRIssueCode.PROCESSING,
125121
fhir_issue_severity=FHIRIssueSeverity.ERROR,
126-
fhir_coding_system="https://fhir.nhs.uk/STU3/ValueSet/Spine-ErrorOrWarningCode-1",
127122
fhir_error_code=FHIRSpineErrorCode.REFERENCE_NOT_FOUND,
128123
fhir_display_message="The given NHS number was not found in our datasets. "
129124
"This could be because the number is incorrect or "
@@ -134,7 +129,6 @@ def log_and_generate_response(
134129
status_code=HTTPStatus.INTERNAL_SERVER_ERROR,
135130
fhir_issue_code=FHIRIssueCode.PROCESSING,
136131
fhir_issue_severity=FHIRIssueSeverity.ERROR,
137-
fhir_coding_system="https://fhir.nhs.uk/STU3/ValueSet/Spine-ErrorOrWarningCode-1",
138132
fhir_error_code=FHIRSpineErrorCode.INTERNAL_SERVER_ERROR,
139133
fhir_display_message="An unexpected internal server error occurred.",
140134
)
@@ -143,17 +137,15 @@ def log_and_generate_response(
143137
status_code=HTTPStatus.FORBIDDEN,
144138
fhir_issue_code=FHIRIssueCode.FORBIDDEN,
145139
fhir_issue_severity=FHIRIssueSeverity.ERROR,
146-
fhir_coding_system="https://fhir.nhs.uk/STU3/ValueSet/Spine-ErrorOrWarningCode-1",
147-
fhir_error_code=FHIRSpineErrorCode.INVALID_NHS_NUMBER,
148-
fhir_display_message="The provided NHS number does not match the record.",
140+
fhir_error_code=FHIRSpineErrorCode.ACCESS_DENIED,
141+
fhir_display_message="Access has been denied to process this request.",
149142
)
150143

151144

152145
NHS_NUMBER_MISSING_ERROR = APIErrorResponse(
153146
status_code=HTTPStatus.BAD_REQUEST,
154147
fhir_issue_code=FHIRIssueCode.INVALID,
155148
fhir_issue_severity=FHIRIssueSeverity.ERROR,
156-
fhir_coding_system="https://fhir.nhs.uk/STU3/ValueSet/Spine-ErrorOrWarningCode-1",
157149
fhir_error_code=FHIRSpineErrorCode.BAD_REQUEST,
158150
fhir_display_message="Bad Request",
159151
)

‎src/eligibility_signposting_api/common/request_validator.py‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717

1818
logger = logging.getLogger(__name__)
1919

20-
condition_pattern = re.compile(r"^\s*[a-zA-Z0-9]+\s*$", re.IGNORECASE)
20+
condition_pattern = re.compile(r"^\s*[a-z0-9]+\s*$", re.IGNORECASE)
2121
category_pattern = re.compile(r"^\s*(VACCINATIONS|SCREENING|ALL)\s*$", re.IGNORECASE)
2222
include_actions_pattern = re.compile(r"^\s*([YN])\s*$", re.IGNORECASE)
2323

@@ -67,10 +67,8 @@ def wrapper(event: LambdaEvent, context: LambdaContext) -> dict[str, Any] | None
6767
)
6868

6969
if not validate_nhs_number(path_nhs_no, header_nhs_no):
70-
message = f"NHS Number {path_nhs_no or ''} does not match the header NHS Number {header_nhs_no or ''}"
71-
return NHS_NUMBER_MISMATCH_ERROR.log_and_generate_response(
72-
log_message=message, diagnostics=message, location_param="id"
73-
)
70+
message = "You are not authorised to request information for the supplied NHS Number"
71+
return NHS_NUMBER_MISMATCH_ERROR.log_and_generate_response(log_message=message, diagnostics=message)
7472

7573
query_params = event.get("queryStringParameters")
7674
if query_params:

‎tests/integration/lambda/test_app_running_as_lambda.py‎

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -304,14 +304,13 @@ def test_given_nhs_number_in_path_does_not_match_with_nhs_number_in_headers_resu
304304
has_entries(
305305
severity="error",
306306
code="forbidden",
307-
diagnostics=f"NHS Number {persisted_person} does "
308-
f"not match the header NHS Number 123{persisted_person!s}",
307+
diagnostics="You are not authorised to request information for the supplied NHS Number",
309308
details={
310309
"coding": [
311310
{
312311
"system": "https://fhir.nhs.uk/STU3/ValueSet/Spine-ErrorOrWarningCode-1",
313-
"code": "INVALID_NHS_NUMBER",
314-
"display": "The provided NHS number does not match the record.",
312+
"code": "ACCESS_DENIED",
313+
"display": "Access has been denied to process this request.",
315314
}
316315
]
317316
},
@@ -351,13 +350,13 @@ def test_given_nhs_number_not_present_in_headers_results_in_error_response(
351350
has_entries(
352351
severity="error",
353352
code="forbidden",
354-
diagnostics=f"NHS Number {persisted_person} does not match the header NHS Number ",
353+
diagnostics="You are not authorised to request information for the supplied NHS Number",
355354
details={
356355
"coding": [
357356
{
358357
"system": "https://fhir.nhs.uk/STU3/ValueSet/Spine-ErrorOrWarningCode-1",
359-
"code": "INVALID_NHS_NUMBER",
360-
"display": "The provided NHS number does not match the record.",
358+
"code": "ACCESS_DENIED",
359+
"display": "Access has been denied to process this request.",
361360
}
362361
]
363362
},

‎tests/unit/common/test_request_validator.py‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,9 @@ def test_validate_request_params_nhs_mismatch(self, caplog):
7979
response_body = json.loads(response["body"])
8080
issue = response_body["issue"][0]
8181
assert issue["code"] == "forbidden"
82-
assert issue["diagnostics"] == ("NHS Number 0987654321 does not match the header NHS Number 1234567890")
82+
assert issue["details"]["coding"][0]["code"] == "ACCESS_DENIED"
83+
assert issue["details"]["coding"][0]["display"] == "Access has been denied to process this request."
84+
assert issue["diagnostics"] == "You are not authorised to request information for the supplied NHS Number"
8385

8486
def test_validate_request_params_nhs_missing_in_path(self, caplog):
8587
mock_handler = MagicMock()

0 commit comments

Comments
 (0)