...

1. Use service request

Validations

Authorization

• Verify the validity of access token
  • Return (401, 'unauthorized') in case of validation fails
• Verify that token is not expired
  • in case of error - return (401, 'unauthorized')
• Check user scopes in order to perform this action (scope = 'service_request:use')
  1. Return (403, 'invalid scopes') in case of invalid scope(s)

...

1. Get service request by ID
2. Service request must be active
   1. $.status  == "active"
      1. in case of error return 409 "Invalid service request status"
3. Service request must be unused
   1. $.used_by is empty object
      
      1. in case of error return 409 "Service request is already used"

Validate employee

Employee to whom service request is assigned must belong to the same legal entity as the requestor

1. Get token metadata
   1. Extract user_id, client_id, client_type
2. Ensure that employee belongs to client
   1. $.used_by.identifier.type.coding[*].system == "eHealth/resources"
   2. $.used_by.identifier.type.coding[*].code == "employee"
   3. $.used_by.identifier.value must belong to client_id (prm.employees.legal_entity_id == :client_id)
      1. in case of error return 422 "You can assign service request only to employee within your legal entity"
3. Check employee_type - only DOCTOR can use service request
   1. employee_type == DOCTOR
      1. in case of error, return 422 "Invalid employee type. Only doctor can use service request"
4. Validate used_by_legal_entity is a current legal_entity
   1. $.used_by_legal_entity.identifier.value==token.client_id
      1. in case of error return 409 "You can assign service request only to your legal entity"

Service logic

1. Update service request attributes
   Set Medical Events DB: service_requests[<id>].is_used = true