Purpose

In case a user was suspected as a fraud there is must be a possibility to Block him (create black list user) and if the suspicion wasn't approved then Unblock the user (deactivate). Blocking user means that the all users related to current party can't be authorized.

Steps to block

1. Get all party_id(s) and their tax_id
2. Find all user_id(s) by party_id(s) (prm.party_users) - new UI/service for NHS admin
3. Knowing user_id (mithril.users) Mithril admin must delete all roles for those users - add search by ID for mithril admin
4. NHS admin add tax_id to black list.
   in order to do that table prm.black_list_users with fields must be created:
   - id 
   - tax_id
   - is_active
   - inserted_at
   - inserted_by
   - updated_at
   - updated_by
5. When creating new employee_request there is must be additional verification. If party.tax_id=black_list_users.tax_id and is_active=true show 422 error (New employee with this tax_id can't be created).
6. To delete user from black_list set is_active=false

Create black list user

Authorize

1. Verify the validity of access token
   1. In case of error - generate 401 response
2. Check user scope (scope = 'bl_user:write') in order to perform this action
   1. In case error - generate 403 response

Verification

1. Check black_list_users.tax_id=$tax_id and is_active=true.
   1. In case of error show 422 error - 'This user is already in a black list'
2. Check all roles were deleted for $tax_id 
   1. Find party_id(s) by $tax_id (prm.parties)
   2. Find all user_id(s) by party_id(s) (prm.party_users)
   3. Check no role_id(s) for user_id(s) (mithril.party_users)
      1. in case of error show 422 error (Not all roles were deleted)

Create new Black list user

1. Create new record in prm.black_list_users