...

• GraphQL schema
• Features

Validation

Validate token

• Verify the validity of access token
  • Return 401 in case validation fails
• token is not expired
  • in case error return 401 
  Validate client_id is NHS
  check client type is NHSin case of error rerun forbidden error (Client is not allowed to the action')

Validate scopes

• Check user scopes in order to perform this action (scope = 'merge_request:read')
  1. Return forbidden in case invalid scope(s) -"Your scope does not allow to access this resource. Missing allowances: merge_request:read"

Verify user and role

Extract from token:

1. Validate client_id (is_blocked=false)
   1. in case of error return 403 Error ('Client is blocked')
2. Check user_roles by client_id 
   1. check whether exist role NHS_REVIEWER 
      1. in case of error return 403 Error ('User doesn't have required role')
3. Validate client_id is NHS
   
   1. check client type is NHS
      1. in case of error rerun forbidden error (Client is not allowed to the action')

...

1. Return response to user limited by context from user's token
   1. return limited response by manual_merge_requests.assignee_id=$user_id and manual_merge_requests.status in ('NEW', 'POSTPONED')
      1. in case of error return forbidden ('You are not allowed to view this merge request)
2. Validate merge_request id. Check merge_requests.id = $.id
   1. in case error return 404 ("Merge request with id=$id doesn't exist")

...