Merge remote-tracking branch 'origin' into feature/GPCAPIM-397-set-up-int-test-provider-requests

Author: davidhamill1-nhs

.github/SECURITY.md

@@ -61,6 +61,21 @@ deploy: clean build # Build project artefact and deploy locally @Pipeline
 	else \
 		$(docker) run --platform linux/amd64 --name gateway-api -p 5000:8080 --env-file .env -d ${IMAGE_NAME} ; \
 	fi
+	@max_attempts=5 ; \
+	attempt=1 ; \
+	while [[ $$attempt -le $$max_attempts ]]; do \
+		if $(docker) ps --filter "name=gateway-api" --filter "status=running" --format "{{.Names}}" | grep -q "^gateway-api$$"; then \
+			exit 0 ; \
+		fi ; \
+		sleep $$((attempt * 2)) ; \
+		attempt=$$((attempt + 1)) ; \
+	done ; \
+	echo "ERROR: gateway-api container failed to start. Logs:" ; \
+	$(docker) logs gateway-api ; \
+	exit 1
+
+deploy-%: # Build project artefact and deploy locally as specified environment - mandatory: name=[name of the environment, e.g. 'dev'] @Pipeline
+	make env-$* deploy
 
 deploy-%: # Build project artefact and deploy locally as specified environment - mandatory: name=[name of the environment, e.g. 'dev'] @Pipeline
 	make env-$* deploy

Makefile

@@ -0,0 +1,23 @@
+# Security
+
+We take security and the protection of private data extremely seriously. If you believe you have found a vulnerability or other issue which has compromised or could compromise the security of any of our systems or private data managed by our systems, please do not hesitate to contact us using the method outlined below.
+
+## Table of Contents
+
+- [Security](#security)
+  - [Table of Contents](#table-of-contents)
+  - [Reporting a vulnerability](#reporting-a-vulnerability)
+  - [General Security Enquiries](#general-security-enquiries)
+
+## Reporting a vulnerability
+
+If you believe you have found a security issue in this repository, please report it using GitHub's private vulnerability reporting:
+
+1. [Report a vulnerability](https://github.com/NHSDigital/clinical-data-gateway-api/security/advisories/new)
+2. Provide details of the issue and steps to reproduce
+
+This creates a private channel for discussion and allows us to coordinate a fix before any public disclosure.
+
+## General Security Enquiries
+
+If you have general enquiries regarding our cybersecurity, please reach out to us at [cybersecurity@nhs.net](cybersecurity@nhs.net)

SECURITY.md

@@ -5,13 +5,15 @@ info:
 
 http:
   method: GET
-  url: https://internal-dev.api.service.nhs.uk/oauth2-mock/userinfo
+  url: https://{{host}}/oauth2-mock/userinfo
   auth:
     type: bearer
-    token: ""
+    token: "{{token}}"
 
 settings:
   encodeUrl: true
   timeout: 0
   followRedirects: true
   maxRedirects: 5
+
+docs: Use the `token` environment variable to set the Authorization header. Do not enter it directly into the header. This ensures that the value is never saved into git.

bruno/gateway-api/collections/APIM/User_Info.yml

@@ -0,0 +1,6 @@
+name: internal-dev
+variables:
+  - name: host
+    value: internal-dev.api.service.nhs.uk
+  - secret: true
+    name: token

bruno/gateway-api/collections/APIM/environments/internal-dev.yml

@@ -11,5 +11,4 @@ class FHIRSystem(StrEnum):
     SDS_USER_ID = "https://fhir.nhs.uk/Id/sds-user-id"
     SDS_ROLE_PROFILE_ID = "https://fhir.nhs.uk/Id/sds-role-profile-id"
     NHS_SERVICE_INTERACTION_ID = "https://fhir.nhs.uk/Id/nhsServiceInteractionId"
-    NHS_MHS_PARTY_KEY = "https://fhir.nhs.uk/Id/nhsMhsPartyKey"
     NHS_SPINE_ASID = "https://fhir.nhs.uk/Id/nhsSpineASID"

gateway-api/src/fhir/constants.py

@@ -4,7 +4,6 @@
 from .elements.identifier import (
     ASIDIdentifier,
     OrganizationIdentifier,
-    PartyKeyIdentifier,
     PatientIdentifier,
     UUIDIdentifier,
 )
@@ -25,7 +24,6 @@
     "GeneralPractitioner",
     "OrganizationIdentifier",
     "Organization",
-    "PartyKeyIdentifier",
     "Patient",
     "PatientIdentifier",
     "Practitioner",

gateway-api/src/fhir/r4/__init__.py

@@ -33,12 +33,6 @@ class ASIDIdentifier(Identifier, expected_system="https://fhir.nhs.uk/Id/nhsSpin
     """A FHIR R4 ASID Identifier."""
 
 
-class PartyKeyIdentifier(
-    Identifier, expected_system="https://fhir.nhs.uk/Id/nhsMhsPartyKey"
-):
-    """A FHIR R4 Party Key Identifier."""
-
-
 class AgnosticDeviceIdentifier(Identifier, expected_system="__unknown__"):
     """TODO [GPCAPIM-358]: define system once JWT Device details are understood."""
 

gateway-api/src/fhir/r4/elements/identifier.py

@@ -7,7 +7,6 @@
 from ..elements.identifier import (
     AgnosticDeviceIdentifier,
     ASIDIdentifier,
-    PartyKeyIdentifier,
 )
 
 
@@ -17,6 +16,6 @@ class Device(Resource, resource_type="Device"):
     model_config = ConfigDict(extra="allow")
 
     identifier: Annotated[
-        list[ASIDIdentifier | PartyKeyIdentifier | AgnosticDeviceIdentifier],
+        list[ASIDIdentifier | AgnosticDeviceIdentifier],
         Field(frozen=True, min_length=1),
     ]

gateway-api/src/fhir/r4/resources/device.py

@@ -12,7 +12,6 @@
     Entry,
     GeneralPractitioner,
     OrganizationIdentifier,
-    PartyKeyIdentifier,
     Patient,
     PatientIdentifier,
     Practitioner,
@@ -375,46 +374,11 @@ def test_create_with_asid_identifier(self) -> None:
             "identifier value should match"
         )
 
-    def test_create_with_party_key_identifier(self) -> None:
-        device = Device.create(
-            identifier=[
-                PartyKeyIdentifier(
-                    system="https://fhir.nhs.uk/Id/nhsMhsPartyKey",
-                    value="P12345-000001",
-                )
-            ],
-        )
-
-        assert device.identifier[0].system == "https://fhir.nhs.uk/Id/nhsMhsPartyKey", (
-            "system should match the party key URI"
-        )
-
-    def test_create_with_mixed_identifiers(self) -> None:
-        device = Device.create(
-            identifier=[
-                ASIDIdentifier(
-                    system="https://fhir.nhs.uk/Id/nhsSpineASID",
-                    value="123",
-                ),
-                PartyKeyIdentifier(
-                    system="https://fhir.nhs.uk/Id/nhsMhsPartyKey",
-                    value="PK-1",
-                ),
-            ],
-        )
-
-        assert len(device.identifier) == 2, "should have two identifiers"
-
     def test_asid_identifier_expected_system(self) -> None:
         assert ASIDIdentifier._expected_system == (
             "https://fhir.nhs.uk/Id/nhsSpineASID"
         ), "_expected_system should be the ASID URI"
 
-    def test_party_key_identifier_expected_system(self) -> None:
-        assert PartyKeyIdentifier._expected_system == (
-            "https://fhir.nhs.uk/Id/nhsMhsPartyKey"
-        ), "_expected_system should be the party key URI"
-
 
 class TestDeviceModelValidate:
     def test_valid_device(self) -> None: