Page Comparison

Purpose

This WS is designed to revoke previously created Device request.

Specification

Apiary

Authorization

1. Verify the validity of access token

   • in case of error - return 401 (“Invalid access token”) in case of validation fails

2. Verify that token is not expired

   • in case of error - return 401 (“Invalid access token”)

3. Check user scopes in order to perform this action (scope = 'device_request:revoke')

   • return 403 (“Your scope does not allow to access this resource. Missing allowances: device_request:revoke”) in case of invalid scope(s)

4. If BLOCK_UNVERIFIED_PARTY_USERS is true, then check party's data match following condition: verification_status != NOT_VERIFIED or (verification_status = NOT_VERIFIED and updated_at > current_date - UNVERIFIED_PARTY_PERIOD_DAYS_ALLOWED):

   • in case not match - return 403 ("Access denied. Party is not verified")

5. If BLOCK_DECEASED_PARTY_USERS is true, check that party is not deceased (party_verification record does not equal to: dracs_death_verification_status = VERIFIED and dracs_death_verification_reason = MANUAL_CONFIRMED):

   • in case of error - return 403 ("Access denied. Party is deceased")

Validations

Validate request

...

1. Validate request is signed

   1. in case of error - return 400 (“Invalid signed content”)

2. Check DS is valid and not expired

3. Validate that DS belongs to the user

   1. Check that DRFO from DS and party.tax_id matches

      1. in case of error - return 422 (“Does not match the signer drfo“)

Validate user

Revoking a Device Request is allowed for a user if he has one of the following active and approved employee that:

• is an author of the Device Request (requester)isMed_AdminEmployee from legal entity where Device Request is created

  • in case of error - return 409 ("Employee is not an author of device request or doesn't have required employee typeOnly an employee from legal entity where device request is created can revoke device request")

Validate transition

Only active device request can be revoked

...

For more information look at [UPD] Device request status model https://e-health-ua.atlassian.net/wiki/spaces/EH/pages/17782014894.

Validate status reason

1. Validate $.status_reason.code is a value from device_request_revoke_reasons dictionary

   1. in case of error - return 422 ("value is not allowed in enum")

...

1. Save signed content to media storage

2. Update device request status to revoked (update also updated_at, updated_by)

3. Get person's authentication_method of MPI

   1. If authentication_method == OTP or THIRD_PERSON (with OTP) :

      1. Check if sms notifications are enabled:

         1. if device_request has a program specified

            1. check that the specified program has setting request_notification_disabled set in false or the setting is absent, else

               1. return an error 409 "Action is not allowed for the specified medical program"

         2. if device_request has no program specified

            1. check config parameter DEVICE_REQUESTS_SMS_ENABLED is set in true

               1. else return an error 409 “Action is disabled by the configuration”

         3. Generate text SMS with template REVOKE_DEVICE_REQUEST_SMS_TEMPLATE.

         4. Send SMS

4. Save internal information to corresponding DB

5. Send StatusChangeEvent to the Event Manager