RC_[UPD]Mark in error Device request

Purpose

This WS is designed to mark in error previously created Device request in case it was entered in error.

Specification

https://medicaleventsmisapi.docs.apiary.io/#reference/device-requests/mark-in-error-device-request/mark-in-error-device-request

Authorization

1. Verify the validity of access token

   • in case of error - return 401 (“Invalid access token”) in case of validation fails

2. Verify that token is not expired

   • in case of error - return 401 (“Invalid access token”)

3. Check user scopes in order to perform this action (scope = 'device_request:mark_in_error')

   • return 403 (“Your scope does not allow to access this resource. Missing allowances: device_request:mark_in_error”) in case of invalid scope(s)

4. If BLOCK_UNVERIFIED_PARTY_USERS is true, then check party's data match following condition: verification_status != NOT_VERIFIED or (verification_status = NOT_VERIFIED and updated_at > current_date - UNVERIFIED_PARTY_PERIOD_DAYS_ALLOWED):

   • in case not match - return 403 ("Access denied. Party is not verified")

5. If BLOCK_DECEASED_PARTY_USERS is true, check that party is not deceased (party_verification record does not equal to: dracs_death_verification_status = VERIFIED and dracs_death_verification_reason = MANUAL_CONFIRMED):

   • in case of error - return 403 ("Access denied. Party is deceased")

Validations

Validate request

Return 422 with the list of validation errors in case validation fails

Validate legal entity

1. Check legal entity type: it has to be in me_allowed_transactions_le_types config parameter, has status = active and nhs_verified = true

   1. in case of error return 409 "Action is not allowed for the legal entity"

Validate digital signature

1. Validate request is signed

   1. in case of error - return 400 (“Invalid signed content”)

2. Check DS is valid and not expired

3. Validate that DS belongs to the user

   1. Check that DRFO from DS and party.tax_id matches

      1. in case of error - return 422 (“Does not match the signer drfo“)

Validate user

Marking in error a Device Request is allowed for a user if he has one of the following active and approved employee that:

• is an Employee from legal entity where Device Request is created

  • in case of error - return 409 ("Only an employee from legal entity where device request is created can mark it in error")

Validate transition

1. Get current device request status

   1. Check that status != “entered_in_error”

      1. in case of error - return 409 error ('Device request in status entered_in_error cannot be marked in error')

For more information look at Device request status model

Validate status reason

1. Validate $.status_reason.code is a value from device_request_mark_in_error_reasons dictionary

   1. in case of error - return 422 ("value is not allowed in enum")

Validate status

The target status value must be submitted in the order of display in the signed content (media storage)

1. Validate $.status is entered_in_error

   1. in case of error - return 422 ("value is not allowed in enum")

Validate content

Signed content must match with device request in DB in order to be marked in error

1. Render device request from DB

2. Exclude $status from signed content

3. Compare rendered device request and signed content

   1. In case both object doesn't match - return 422 ('Signed content doesn't match with previously created device request')

Service logic

1. Save signed content to media storage

2. Update device request status to entered-in-error (update also updated_at, updated_by)

3. Get person's authentication_method according to logic:

   1. If inform_with exists in device request and is not empty, check:

      1. Authentication method exists in person_authentication_methods table in MPI DB (with is_active=true), is active (ended_at > now() or null)

      2. Get value of THIRD_PERSON_CONFIDANT_PERSON_RELATIONSHIP_CHECK config parameter, if it is set to true - for authentication method with type = THIRD_PERSON check that person from value is an approved confidant for a person from device request – exists active and approved confidant person relationship between person from request and confidant_person_id from authentication method value (using following logic Check confidant person relationship with person_id = person from request and confidant_person_id = value from auth method - expected :ok, :approved response)

         1. in case any validation failed - do not send SMS to person

         2. else - get authentication_method from inform_with

   2. If inform_with does not exist in device request or is empty - get default authentication_method of person from MPI using logic Determination of a default authentication method and return person's active auth_methods

4. If authentication_method == OTP or THIRD_PERSON (with OTP),:

   1. Check if sms notifications are enabled and generate template:

      1. if device_request has a program specified

         1. check that the specified program has setting request_notification_disabled set in false or the setting is absent

         2. if device_request is for assistive device (device_request.code OR at least one classification type of device_request.code_reference is in dictionary configuration “assistive_devices”) generate SMS text with template MARK_IN_ERROR_ASSISTIVE_DEVICE_REQUEST_SMS_TEMPLATE

         3. else generate text SMS with template MARK_IN_ERROR_DEVICE_REQUEST_SMS_TEMPLATE

      2. if device_request has no program specified

         1. if device_request is for assistive device (device_request.code OR at least one classification type of device_request.code_reference is in dictionary configuration “assistive_devices”)

            1. check that ASSISTIVE_DEVICE_REQUESTS_SMS_ENABLED is set in true

            2. generate text SMS with template MARK_IN_ERROR_ASSISTIVE_DEVICE_REQUEST_SMS_TEMPLATE

         2. else check config parameter DEVICE_REQUESTS_SMS_ENABLED is set in true

            1. generate text SMS with template MARK_IN_ERROR_DEVICE_REQUEST_SMS_TEMPLATE

   2. Send SMS

5. Save internal information to corresponding DB

6. Send StatusChangeEvent to the Event Manager