RC_[UPD] Get approvals

Purpose

This WS intended to get a list of patient’s approvals filtered by search params.

Specification

Apiary

Authorization

• Verify the validity of access token

  • Return (401, 'Invalid access token') in case of validation fails

• Verify that token is not expired

  • in case of error - return (401, 'Invalid access token')

• Check user scopes in order to perform this action (scope = 'approval:read')

  • Return (403, 'Your scope does not allow to access this resource. Missing allowances: approval:read') in case of invalid scope(s)

Validate Patient

• Get Patient identifier from the URL

• Check it exists in DB

  • Return 404 ('Person is not found') in case of error

Validate Approval

• Get Approval identifier from the URL

• Check it exists in DB

  • Return 404 ('not found') in case of error

Validate User

• Extract user_id from token.

• Check user has an active declaration with a patient from URL (can get all approvals) or approval is granted to user (can get own approval: granted_to OR created_by ):

  • Return 200 with empty array in case the employee doesn't have an active declaration with the patient or approval is granted to user

Service logic

Service returns all approvals related to the patient filtered by submitted parameters:

• Get all approvals by patient_id from approvals collection (MongoDB)

• Filter list above by submitted search parameters

  • granted_resource_type must be applied to both granted_resources and granted_resource_types

• Render a response according to specification.

  • if granted_resource_types is not defined on resource in DB - render it as empty array on response according to specification