Page Comparison

Send & Get API-key

All Some clients (all client_typeswhich `access_type` = BROKER) must be send (mandatory) API-key as a attribute `API-key` in HEADER all request.

Example:

curl --include \
     --request POST \
     --header "Content-Type: application/json" \
     --header "Authorization: Bearer mF_9.B5f-4.1JqM" \
     --header "API-key: d09vQUFlWTZ6Q0RXRDJISldUOVQ3dz09" \
     --data-binary "{
  \"medication_request_request\": { 
....

Manage MIS

broker scope 

For some clients (client_type = MIS) which provide transfer for call API - we need mandatory validate possibility access to API endpoints.

Proposed use new column attribute `validate_broker_scopes` (boolean) in table `client_types`.in JSON object in column `client.priv_settings`.

If attribute `broker_scopes` not exist in `client.priv_settings` - we don`t need validate access over broker!

For clients (client_type = MIS) on which we will check access for call API endpoint - we need describe the list `broker_scopes`. 
Proposed manage & store list  `broker_scopes` in attribute `priv_settings` in table `clients`. 

Example:

{
  "allowed_grant_types": [
    	"password",
    	"access_token"
  ],
  "access_type": "direct",
  "broker_scopes": 
  		"legal_entity:read
		 declaration:read
		 employee:read"
}

In case of need complex disconnect MIS for transfer of call API endpoints - we need full clear him `broker_scopes`.
Clear, but not delete!

Validate MIS transfer scope

When MSP call specific API endpoint over (transfer) MIS we need validate possibility to access.

1. Get `client_id` from `token`
2. Read `clients` for `client_id`.   (further in the text - `REQUEST_CLIENT`)Read 
3. Extract `access_type` from `priv_settings`. 
4. If `access_type` = `BROKER` 
   1. Read   `API-key`
   from  `
   1. from HEADER
      1. if API-key
   `
   1. 1. missing - return 401 error  "API-KEY header required !" 
   2. Validate  `API-key`.
      1. Validate exists `secret` in table `clients`
         1. if invalid - return 401 error  "
   Not found
   1. 1. 1. API-
   key
   1. 1. 1. KEY header required !"
   (!!! TBD)Read `client_types` for REQUEST_CLIENT.
   1. 1. 1.  
   Validate `access_over_broker`=TRUE If invalid - break validation.
   1. 2. Read `clients` with `secret`(API-key) in header.  (further in the text - `BROKER_CLIENT`)
   Read
   1. 1. Extract `
   client_types` for this BROKER_CLIENT
   1. 1. broker_scopes` from `priv_settings` . 
         
   Validate
   1. 1. 1. if not found `
   validate_
   1. 1. 1. broker_scopes`
   =TRUE if invalid - return
   1. 1. 1. -  return 401 error  "Incorrect
   API-key
   1. 1. 1. broker settings!"
   (!!! TBD)
5. Get `broker_scopes` from  `settings` in table `clients` for `BROKER_CLIENT`
6. 1. 1. 1.  
      2. Read needed scopes for call API Endpoint (read from GateWay configuration - "/gateway-config.yaml")
      3. Validate exist
   all
   1. 1. needed scopes in `broker_scopes` of `BROKER_CLIENT`.
         1. if invalid - return 403 error 
   "Conflict !" (!!! TBD)
   1. 1. 1. " Scope is not allowed by broker"
7. If `access_type` = `DIRECT` 
   1. break validation.

Configuration examples 

Tests

MIS Authorization Test Page