Page Comparison

Send & Get API-key

Some clients (which `access_type` = BROKER) must be send (mandatory) API-key as a attribute `API-key` in HEADER all request.

Example:

curl --include \
     --request POST \
     --header "Content-Type: application/json" \
     --header "Authorization: Bearer mF_9.B5f-4.1JqM" \
     --header "API-key: d09vQUFlWTZ6Q0RXRDJISldUOVQ3dz09" \
     --data-binary "{
  \"medication_request_request\": { 
....

Manage MIS broker scope 

For some clients (client_type = MIS) which provide transfer for call API - we need mandatory validate possibility access to API endpoints.

Proposed use new attribute `broker_scopes` in JSON object in column `client.priv_settings`.

If attribute `broker_scopes` not exist in `client.priv_settings` - we don`t need validate access over broker!

For clients (client_type = MIS) on which we will check access for call API endpoint - we need describe the list `broker_scopes`. 
Proposed manage & store list  `broker_scopes` in attribute `priv_settings` in table `clients`. 

Example:

{
  "allowed_grant_types": [
    	"password",
    	"access_token"
  ],
  "access_type": "direct",
  "broker_scopes": 
  		"legal_entity:read
		 declaration:read
		 employee:read"
}

In case of need complex disconnect MIS for transfer of call API endpoints - we need full clear him `broker_scopes`.
Clear, but not delete!

Validate MIS transfer scope

When MSP call specific API endpoint over (transfer) MIS we need validate possibility to access.

1. Get `client_id` from `token`
2. Read `clients` for `client_id`.   (further in the text - `REQUEST_CLIENT`)
3. Extract `access_type` from `priv_settings`. 
4. If `access_type` = `BROKER` 
   1. Read   `API-key` from HEADER
      1. if API-key missing - return 422 401 error  "API-KEY header required !" 
   2. Validate  `API-key`.
      1. Validate exists `secret` in table `clients`
         1. if invalid - return 422 401 error  "API-KEY header required !" 
      2. Read `clients` with `secret`(API-key) in header.  (further in the text - `BROKER_CLIENT`)
      3. Extract `broker_scopes` from `priv_settings` . 
         
         1. if not found `broker_scopes` -  return 422 401 error  "Incorrect broker settings!" 
      4. Read needed scopes for call API Endpoint (read from GateWay configuration - "/gateway-config.yaml")
      5. Validate exist needed scopes in `broker_scopes` of `BROKER_CLIENT`.
         1. if invalid - return 422 403 error " Scope is not allowed by broker !broker"
5. If `access_type` = `DIRECT` 
   1. break validation.

Configuration examples 

Tests

MIS Authorization Test Page