ЕСОЗ - публічна документація

RC_(MC-1180)_[NEW] Get Diagnostic Report details in Composition context

Owned by Kateryna Haleta (SoE eHealth)
Last updated: Sep 04, 2024Version comment
1 min read

Purpose

This method allows to get single Diagnostic Report by its identifier using Composition context. It is designed to provide access to resources mentioned in Composition in case user has active Approval to such Composition

Key points

  1. Only authenticated and authorized employee with appropriate scope can use this method

  2. Method returns a single Diagnostic Report via Composition context only in case user has active Approval to such Composition

  3. ABAC rules are used here

    1. Employee with active approval can read all the data of specified in approval composition - @rule_18

Specification

https://ehealthmedicaleventsapi.docs.apiary.io/#reference/medical-events/composition/get-diagnostic-report-details-in-composition-context

Authorization

  • Verify the validity of access token

    • in case of error - return 401 “Invalid access token” in case of validation fails

  • Verify that token is not expired

    • in case of error - return 401 “Invalid access token”

  • Check user and client scopes in order to perform this action (scope = 'composition:read')

    • return 403 “Your scope does not allow to access this resource. Missing allowances: composition:read” in case of invalid scope(s)

  • Access to the resource is also managed by ABAC module

Validate Patient

  • Get Patient identifier from the URL

  • Check it exists in DB

    • Return 404 ('not found') in case of error

Validate Composition

  • Get Composition identifier from the URL

  • Check it exists in DB

    • Return 404 ('not found') in case of error

  • Check Composition belongs to patient

    • Return 403 ('forbidden') in case of error

Service logic

Service returns specified Diagnostic Report related to the patient:

  • Get Diagnostic Report from diagnostic_reports collection (MongoDB)

    • Check it exists in DB

      • Return 404 ('not found') in case of error

    • Check Diagnostic Report belongs to the patient

      • Return 403 ('forbidden') in case of error

  • Render response according to specification

ЕСОЗ - публічна документація