Page Comparison

...

Specification

  "Reads a single `Observation` using its globally unique ID and person's mpi id."
  observation(personId: ID!, id: ID!): Observation

...

1. This is a graphQl query used in Administration panel only

2. Only authenticated and authorized NHS employee with appropriate scope can get observation details.

3. Query returns single observation by person (mpi id) and observation identifier.

4. Filtration with forbidden group items not implemented for observations, so it not used here.

5. Query should be invoked only if Justification for monitoring exists for current user and corresponding patient (ABAC rule_-2).

...

• Verify the validity of access token

  • in case of error - return 401 (“Invalid access token”) in case of validation fails

• Verify that token is not expired

  • in case of error - return 401 (“Invalid access token”)

• Check user scopes in order to perform this action (scope = 'observation:practical_monitor')

  • return 403 (“Your scope does not allow to access this resource. Missing allowances: observation:practical_monitor”) in case of invalid scope(s)

• Check user has access to resource according to @rule_-2in ABAC

  • return 403 (“Access denied. Justification required“) in case of error

...