Page Comparison

Send & Get API-key

Some clients (which `access_type` = BROKER) must be send (mandatory) API-key as a attribute `API-key` in HEADER all request.

Example:

curl --include \
     --request POST \
     --header "Content-Type: application/json" \
     --header "Authorization: Bearer mF_9.B5f-4.1JqM" \
     --header "API-key: d09vQUFlWTZ6Q0RXRDJISldUOVQ3dz09" \
     --data-binary "{
  \"medication_request_request\": { 
....

Manage MIS broker scope 

For some clients (client_type = MIS) which provide transfer for call API - we need mandatory validate possibility access to API endpoints.

Proposed use new attribute `broker_scopes` in JSON object in column `client.priv_settings`.

If attribute `broker_scopes` not exist in `client.priv_settings` - we don`t need validate access over broker!

For clients (client_type = MIS) on which we will check access for call API endpoint - we need describe the list `broker_scopes`. 
Proposed manage & store list  `broker_scopes` in attribute `priv_settings` in table `clients`. 

Example:

{
  "allowed_grant_types": [
    	"password",
    	"access_token"
  ],
  "access_type": "direct",
  "broker_scopes": 
  		"legal_entity:read
		 declaration:read
		 employee:read"
}

In case of need complex disconnect MIS for transfer of call API endpoints - we need full clear him `broker_scopes`.
Clear, but not delete!

Validate MIS transfer scope

When MSP call specific API endpoint over (transfer) MIS we need validate possibility to access.

1. Get `client_id` from `token`
2. Read `clients` for `client_id`.   (further in the text - `REQUEST_CLIENT`)
3. Read  Extract `access_type` from `priv_settings`. 
4. If `access_type` = `BROKER` 
   1. Read   `API-key` from HEADER
      1. if API-key missing - return 401 error  "API-KEY header required !" 
   2. Validate  `API-key`.
      1. Validate exists `secret` in table `clients`
         1. if invalid - return 401 error  "
   Not found
   1. 1. 1. API-
   key
   1. 1. 1. KEY header required !"
   (!!! TBD)Read `client_types` for REQUEST_CLIENT.
   1. 1. 1.  
   Validate `access_over_broker`=TRUE 
5. If invalid - break validation.
1. 1. Read `clients` with `secret`(API-key) in header.  (further in the text - `BROKER_CLIENT`)
Read
1. 1. Extract `
client_types` for this BROKER_CLIENT
1. 1. broker_scopes` from `priv_settings` . 
      
Validate
1. 1. 1. if not found `
validate_
1. 1. 1. broker_scopes`
=TRUE if invalid - return
1. 1. 1. -  return 401 error  "Incorrect
API-key
1. 1. 1. broker settings!"
(!!! TBD)
6. Get `broker_scopes` from  `settings` in table `clients` for `BROKER_CLIENT`
7. 1. 1. 1.  
      2. Read needed scopes for call API Endpoint (read from GateWay configuration - "/gateway-config.yaml")
      3. Validate exist
   all
   1. 1. needed scopes in `broker_scopes` of `BROKER_CLIENT`.
         1. if invalid - return
   error "Conflict !" (!!! TBD)
   1. 1. 1. 403 error " Scope is not allowed by broker"
8. If `access_type` = `DIRECT` 
   1. break validation.

Configuration examples 

Tests

MIS Authorization Test Page