...
Only authenticated and authorized employee with appropriate scope can use this method
Method returns a single Condition via Composition context only in case user has active Approval to such Composition
ABAC rules are used here
Employee with active approval can read all the data of specified in approval composition - @rule_18
Specification
https://ehealthmedicaleventsapiehealthmedicalevents991v11.docs.apiary.io/#reference/medical-events/composition/get-condition-details-in-composition-context
Authorization
Verify the validity of access token
in case of error - return 401 “Invalid access token” in case of validation fails
Verify that token is not expired
in case of error - return 401 “Invalid access token”
Check user and client scopes in order to perform this action (scope = 'composition:read')
return 403 “Your scope does not allow to access this resource. Missing allowances: composition:read” in case of invalid scope(s)
Access to the resource is also managed by ABAC module
Validate Patient
Get Patient identifier from the URL
Check it exists in DB
Return 404 ('not found') in case of error
...