Table of Contents | ||
---|---|---|
|
Purpose
This method allows to get single Condition by its identifier using Composition context. It is designed to provide access to resources mentioned in Composition in case user has active Approval to such Composition
Key points
Only authenticated and authorized employee with appropriate scope can use this method
Method returns a single Condition via Composition context only in case user has active Approval to such Composition
ABAC rules are used here
Employee with active approval can read all the data of specified in approval composition - @rule_18
Specification
Authorization
Verify the validity of access token
in case of error - return 401 “Invalid access token” in case of validation fails
Verify that token is not expired
in case of error - return 401 “Invalid access token”
Check user and client scopes in order to perform this action (scope = 'composition:read')
return 403 “Your scope does not allow to access this resource. Missing allowances: composition:read” in case of invalid scope(s)
Access to the resource is also managed by ABAC module
Validate Patient
Get Patient identifier from the URL
Check it exists in DB
Return 404 ('not found') in case of error
Validate Composition
Get Composition identifier from the URL
Check it exists in DB
Return 404 ('not found') in case of error
Check Composition belongs to patient
Return 403 ('forbidden') in case of error
Service logic
Service returns specified Condition related to the patient:
Get Condition from
conditions
collection (MongoDB)Check it exists in DB
Return 404 ('not found') in case of error
Check Condition belongs to the patient
Return 403 ('forbidden') in case of error
Render response according to specification