4941 performing javascript reject operation during consent validation does not return 403 #4951
Conversation
…n-during-consent-validation-does-not-return-403
Codecov ReportPatch coverage has no change and project coverage change:
Additional details and impacted files@@ Coverage Diff @@
## master #4951 +/- ##
============================================
+ Coverage 81.32% 83.16% +1.83%
- Complexity 23650 25558 +1908
============================================
Files 1425 1557 +132
Lines 86399 93239 +6840
Branches 11677 12423 +746
============================================
+ Hits 70265 77541 +7276
+ Misses 10947 10232 -715
- Partials 5187 5466 +279 ☔ View full report in Codecov by Sentry. |
| @@ -58,6 +58,7 @@ public ConsentOutcome canSeeResource(RequestDetails theRequestDetails, IBaseReso | |||
| Observation obs = (Observation)theResource; | |||
| if (obs.getCategoryFirstRep().hasCoding("http:https://hl7.org/fhir/codesystem-observation-category.html", "laboratory")) { | |||
| return ConsentOutcome.REJECT; | |||
There was a problem hiding this comment.
remove commented code.
instead, add to the documentation (line 54-56):
A real interceptor might do something more nuance or entirely forbid the operation by returning ConsentOutcome.FORBID;
...hir-server/src/main/java/ca/uhn/fhir/rest/server/interceptor/consent/ConsentInterceptor.java
Outdated
Show resolved
Hide resolved
...hir-server/src/main/java/ca/uhn/fhir/rest/server/interceptor/consent/ConsentInterceptor.java
Show resolved
Hide resolved
...-structures-r4/src/test/java/ca/uhn/fhir/rest/server/interceptor/ConsentInterceptorTest.java
Show resolved
Hide resolved
| * The requested operation cannot proceed, and an operation outcome suitable for | ||
| * the user is available | ||
| */ | ||
| FORBID |
There was a problem hiding this comment.
I dont' understand what this change is for. How is FORBID different from REJECT? It has identical javadocs which suggests that it is the same. If it's not the same, the javadocs need to be updated to reflect exactly when someone would use one vs the other, and the actual documentation on hapifhir.io/hapi-fhir/docs should also be updated to make this clear. Also Unit Tests should be added that exercize the differences.
There was a problem hiding this comment.
The intend behind adding the FORBID operation outcome is to permit a client to specify that the server should return 403 from any of the consent service javascript callback as REJECT will only trigger a 403 from 'consentStartOperation'.
Comment and documentation will be updated.
What was done: