[PRMP-1465] Post User Restriction by SWhyteAnswer · Pull Request #1131 · NHSDigital/national-document-repository

SWhyteAnswer · 2026-02-25T14:03:16Z

Overview

Jira ticket: TBC

Description

Context

Checklist

Tasks for all changes:

Additional tasks for UI changes (delete if not applicable):

1. I have added evidence (to this PR) e.g. screenshots/gifs of all visual changes.

lambdas/handlers/post_user_restriction_handler.py

steph-torres-nhs · 2026-02-26T14:14:54Z

lambdas/handlers/post_user_restriction_handler.py

+@override_error_check
+@ensure_environment_variables(
+    names=[
+        "USER_RESTRICTIONS_TABLE_NAME",


double check this is the right var from the terraform

steph-torres-nhs · 2026-02-26T14:18:14Z

lambdas/handlers/post_user_restriction_handler.py

+    body = event.get("body")
+    if not body:
+        logger.error("Missing request body")
+        return ApiGatewayResponse(
+            400, "Missing request body", "POST"
+        ).create_api_gateway_response()
+
+    try:
+        payload = json.loads(body)
+    except json.JSONDecodeError as exc:
+        logger.error(exc)
+        return ApiGatewayResponse(
+            400, "Invalid request body", "POST"
+        ).create_api_gateway_response()
+
+    # Required fields for creating a restriction.
+    smart_card_id = payload.get("smart_card_id")
+    nhs_number = payload.get("nhs_number")
+    if not smart_card_id or not nhs_number:
+        logger.error("Missing required fields")
+        return ApiGatewayResponse(
+            400, "Missing required fields", "POST"
+        ).create_api_gateway_response()


this could be extracted into a separate function, parse_body?
think the body should always be valid JSON so might not need to handle this error
do we want a model to validate the request body against?
body will be coming from front end so probably camel case

steph-torres-nhs · 2026-02-26T14:21:35Z

lambdas/handlers/post_user_restriction_handler.py

+    authorization = request_context.authorization or {}
+    creator = authorization.get("nhs_user_id")
+    ods_code = authorization.get("selected_organisation", {}).get("org_ods_code")
+    if not creator or not ods_code:
+        logger.error("Missing user context")
+        return ApiGatewayResponse(
+            400, "Missing user context", "POST"
+        ).create_api_gateway_response()


we could use the ods_util here, or create a new one that does both the creator and ods to be used with the other lambdas too?

steph-torres-nhs · 2026-02-26T14:26:17Z

lambdas/services/post_user_restriction_service.py

+        creator: str,
+    ) -> UserRestriction:
+        if smart_card_id == creator:
+            raise ValueError("You cannot create a restriction for yourself")


create custom exception

steph-torres-nhs · 2026-02-26T14:27:27Z

lambdas/services/post_user_restriction_service.py

+            nhs_number=nhs_number,
+            custodian=ods_code,
+            creator=creator,
+            restricted_user_name=restricted_user_name,


not on the model, no need to write to db

steph-torres-nhs · 2026-02-26T14:31:32Z

lambdas/handlers/post_user_restriction_handler.py

+        restriction = service.create_restriction(
+            smart_card_id=smart_card_id,
+            nhs_number=nhs_number,
+            ods_code=ods_code,


steph-torres-nhs · 2026-02-26T14:33:41Z

lambdas/services/post_user_restriction_service.py

+            raise ValueError("You cannot create a restriction for yourself")
+
+        practitioner = self.healthcare_service.get_practitioner(smart_card_id)
+        restricted_user_name = f"{practitioner.first_name} {practitioner.last_name}"


believe we are returning this the the frontend, may need to change what is returned from this function

steph-torres-nhs · 2026-02-26T14:36:12Z

lambdas/tests/unit/handlers/test_post_user_restriction_handler.py

+@pytest.fixture
+def set_env(monkeypatch, set_env):
+    monkeypatch.setenv("USER_RESTRICTIONS_TABLE_NAME", MOCK_RESTRICTIONS_TABLE)
+    monkeypatch.setenv("HEALTHCARE_WORKER_API_URL", HEALTHCARE_WORKER_API_URL)
+    yield
+


use conftest

steph-torres-nhs · 2026-02-26T14:37:13Z

lambdas/tests/unit/handlers/test_post_user_restriction_handler.py

+MOCK_SMART_CARD_ID = "smartcard-uuid-1234"
+MOCK_CREATOR_ID = "creator-uuid-5678"
+MOCK_RESTRICTIONS_TABLE = "test-user-restrictions-table"


github-actions · 2026-03-05T11:13:06Z

Code security issues found

View full details here.

sonarqubecloud · 2026-03-05T11:16:44Z

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
95.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

NogaNHS · 2026-03-06T14:35:31Z

lambdas/handlers/create_user_restriction_handler.py

+        "HEALTHCARE_WORKER_API_URL",
+    ],
+)
+@handle_lambda_exceptions


add @validate patient id

NogaNHS · 2026-03-06T14:40:23Z

lambdas/handlers/create_user_restriction_handler.py

+
+    restricted_smartcard_id, nhs_number = parse_body(event.get("body"))
+
+    patient_id = (event.get("queryStringParameters") or {}).get("patientId")


extract_nhs_number_from_event

steph-torres-nhs · 2026-03-06T14:42:53Z

lambdas/enums/lambda_error.py

+    """
+       Errors for UserRestriction lambda
+    """


could we make some of these more generic?

steph-torres-nhs · 2026-03-06T14:45:54Z

lambdas/handlers/create_user_restriction_handler.py

+        raise CreateUserRestrictionLambdaException(
+            400,
+            LambdaError.CreateRestrictionMissingBody,
+        )


should raise a generic e.g "RequestError" and allow the handler to handle status code?

steph-torres-nhs · 2026-03-06T14:48:28Z

lambdas/services/create_user_restriction_service.py

+class CreateUserRestrictionService:
+    def __init__(self):
+        self.table_name = os.getenv("RESTRICTIONS_TABLE_NAME")
+        self.db_service = DynamoDBService()


use the user_restriction_dyanmodb_service from branch PRMP-1446? handles model validation etc for us

steph-torres-nhs · 2026-03-06T14:50:11Z

lambdas/services/create_user_restriction_service.py

should be in user_restrictions dir

steph-torres-nhs · 2026-03-06T14:50:54Z

lambdas/tests/unit/handlers/test_create_user_restriction_handler.py

+    mock_request_context,
+    mock_user_restriction_enabled,
+):
+    mock_service.create_restriction.return_value = "some-uuid"


we can use TEST_UUID here

steph-torres-nhs · 2026-03-06T14:55:01Z

lambdas/services/create_user_restriction_service.py

+        if restricted_smartcard_id == creator:
+            raise UserRestrictionException(
+                "You cannot create a restriction for yourself",
+            )


should the handler handle this?

NogaNHS · 2026-03-06T14:56:23Z

lambdas/services/create_user_restriction_service.py

+        restriction = UserRestriction(
+            restricted_user=restricted_smartcard_id,
+            nhs_number=nhs_number,
+            custodian=custodian,


Do we need to call PDS to validate the custodian here?

NogaNHS · 2026-03-06T15:14:30Z

lambdas/services/create_user_restriction_service.py

+        self.table_name = os.getenv("RESTRICTIONS_TABLE_NAME")
+        self.db_service = DynamoDBService()
+        self.healthcare_service = get_healthcare_worker_api_service()
+


Before creating we need to check that there isn't an existing one for the patient/user

NogaNHS · 2026-03-06T16:21:04Z

lambdas/tests/unit/models/user_restrictions/test_user_restrictions.py

Why are you removing this?

SWhyteAnswer temporarily deployed to development February 25, 2026 14:03 — with GitHub Actions Inactive

steph-torres-nhs reviewed Feb 26, 2026

View reviewed changes

lambdas/handlers/post_user_restriction_handler.py Outdated Show resolved Hide resolved

steph-torres-nhs reviewed Feb 26, 2026

View reviewed changes

SWhyteAnswer force-pushed the PRMP-1465 branch from 5d7ec4e to 8f6b18c Compare February 26, 2026 16:27

SWhyteAnswer temporarily deployed to development February 26, 2026 16:27 — with GitHub Actions Inactive

SWhyteAnswer force-pushed the PRMP-1465 branch from 8f6b18c to 5af470e Compare February 27, 2026 14:04

SWhyteAnswer temporarily deployed to development February 27, 2026 14:04 — with GitHub Actions Inactive

SWhyteAnswer temporarily deployed to development February 27, 2026 14:30 — with GitHub Actions Inactive

SWhyteAnswer temporarily deployed to development February 27, 2026 14:32 — with GitHub Actions Inactive

SWhyteAnswer temporarily deployed to development February 27, 2026 14:39 — with GitHub Actions Inactive

SWhyteAnswer temporarily deployed to development February 27, 2026 14:59 — with GitHub Actions Inactive

SWhyteAnswer temporarily deployed to development February 27, 2026 15:15 — with GitHub Actions Inactive

SWhyteAnswer temporarily deployed to development February 27, 2026 16:12 — with GitHub Actions Inactive

SWhyteAnswer had a problem deploying to development March 2, 2026 10:09 — with GitHub Actions Failure

SWhyteAnswer had a problem deploying to development March 2, 2026 10:23 — with GitHub Actions Failure

SWhyteAnswer had a problem deploying to development March 2, 2026 11:02 — with GitHub Actions Failure

SWhyteAnswer had a problem deploying to development March 2, 2026 15:52 — with GitHub Actions Failure

SWhyteAnswer force-pushed the PRMP-1465 branch from b1c56b1 to bbc3948 Compare March 2, 2026 15:52

SWhyteAnswer had a problem deploying to development March 2, 2026 15:52 — with GitHub Actions Failure

SWhyteAnswer had a problem deploying to development March 3, 2026 13:19 — with GitHub Actions Failure

SWhyteAnswer temporarily deployed to development March 3, 2026 13:29 — with GitHub Actions Inactive

SWhyteAnswer added 17 commits March 5, 2026 11:11

[PRMP-1465] authorizer

752b90f

[PRMP-1465] check nhsnumber = patientid

3539c46

[PRMP-1465] correct 400 return

85b0d15

[PRMP-1465] remove response object

1f0c7f7

[PRMP-1465] renaming files and adding lambda workflow

c7b9748

[PRMP-1465] adding correct healthcare worker service

e27e6fc

[PRMP-1465] adding feature flags

a142643

[PRMP-1645] feature flag tests

89256b9

[PRMP-1465] format

dbaa4e7

[PRMP-1465] format

646ff2e

[PRMP-1465] removing camel

55efdbb

[PRMP-1465] auth to restrictive

3227dfa

[PRMP-1469] error handling best practices

ebae1c9

[PRMP-1465] format

f622f3f

[PRMP-1465] format

bfeb269

[PRMP-1465] test improvements

c5d1b04

[PRMP-1465] fm

afdd05c

NogaNHS reviewed Mar 6, 2026

View reviewed changes

steph-torres-nhs reviewed Mar 6, 2026

View reviewed changes

lambdas/services/create_user_restriction_service.py

Copy link

Contributor

steph-torres-nhs Mar 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should be in user_restrictions dir

steph-torres-nhs reviewed Mar 6, 2026

View reviewed changes

NogaNHS reviewed Mar 6, 2026

View reviewed changes

lambdas/tests/unit/models/user_restrictions/test_user_restrictions.py

Copy link

Contributor

NogaNHS Mar 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why are you removing this?


		restricted_smartcard_id, nhs_number = parse_body(event.get("body"))

		patient_id = (event.get("queryStringParameters") or {}).get("patientId")

Conversation

SWhyteAnswer commented Feb 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Overview

Description

Context

Checklist

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Mar 5, 2026

Code security issues found

Uh oh!

sonarqubecloud bot commented Mar 5, 2026

Quality Gate passed

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

SWhyteAnswer commented Feb 25, 2026 •

edited

Loading