Purpose

In case a user was suspected as a fraud there is must be a possibility to Block him (create black list user) and if the suspicion wasn't approved then Unblock the user (deactivate). Blocking user means that the all users related to current party can't be authorized.

Steps to block

1. Get all party_id(s) and their tax_id (tax_id or passport_number)
2. Find all user_id(s) by party_id(s) (prm.party_users) - new UI/service for NHS admin (Get Users by party_id list)
3. Knowing user_id (mithril.users) Mithril admin must block all those users (is_blocked=true) -
4. NHS admin add tax_id to black list.
   in order to do that table prm.black_list_users with fields must be created:
   - id 
   - tax_id
   - is_active
   - inserted_at
   - inserted_by
   - updated_at
   - updated_by
5. When creating new employee_request there is must be additional verification.
   1. If party.tax_id=black_list_users.tax_id and is_active=true show 422 error (New employee with this tax_id can't be created).
6. Expire all current tokens for all user_id(s) by party_id(s) (mithril.tokens):
   1. expires_at= now()
7. To delete user from black_list set is_active=false

Specification

  Apiary

Create black list user

Authorize

1. Verify the validity of access token
   1. In case of error - generate 401 response
2. Check user scope (scope = 'bl_user:write') in order to perform this action
   1. In case error - generate 403 response

Verification

1. Check black_list_users.tax_id=$tax_id and is_active=true.
   1. In case of error show 422 error - 'This user is already in a black list'
2. Check all roles were deleted for $tax_id 
   1. Find party_id(s) by $tax_id (prm.parties)
   2. Find all user_id(s) by party_id(s) (prm.party_users)
   3. Check there all user(s) for user_id(s) are blocked(mithril.users)
      1. in case of error show 422 error (Not all users were blocked)

Create new Black list user

1. Create new record in prm.black_list_users