NRL-1949 Add v2 perm policy to metadata & update producer endpoints

NHSDigital · sandyforresternhs · Mar 12, 2026 · Feb 26, 2026 · Mar 3, 2026 · Mar 5, 2026
commit 81ada466d04710671761e33d4fc8c19ea25b9bb0
@@ -76,12 +76,18 @@ def _check_permissions(
             expression="custodian.identifier.value",
         )
 
-    if core_model.type not in metadata.pointer_types:
+    allowed_types = (
+        metadata.nrl_permissions_policy.types
+        if metadata.nrl_permissions_policy
+        else metadata.pointer_types
+    )
+
+    if core_model.type not in allowed_types:
         logger.log(
             LogReference.PROCREATE005,
             ods_code=metadata.ods_code,
             type=core_model.type,
-            pointer_types=metadata.pointer_types,
+            pointer_types=allowed_types,
         )
         return SpineErrorResponse.AUTHOR_CREDENTIALS_ERROR(
             diagnostics="The type of the provided DocumentReference is not in the list of allowed types for this organisation",

@@ -731,6 +731,128 @@ def test_create_document_reference_pointer_type_not_allowed(
     }
 
 
+@mock_aws
+@mock_repository
+@freeze_time("2024-03-21T12:34:56.789")
+@freeze_uuid("00000000-0000-0000-0000-000000000001")
+@patch("nrlf.core.decorators.get_pointer_permissions_v2")
+def test_create_document_reference_happy_path_v2(
+    get_pointer_permissions_mock, repository: DocumentPointerRepository
+):
+    doc_ref_data = load_document_reference_data("Y05868-736253002-Valid")
+
+    v2_headers = create_headers(
+        additional_headers={
+            "nhsd-end-user-organisation-ods": "Y05868",
+            "nhsd-nrl-app-id": "Y05868-TestApp-12345678",
+        }
+    )
+    v2_headers.pop("nhsd-client-rp-details")
+
+    get_pointer_permissions_mock.return_value = {
+        "access_controls": [],
+        "types": ["http://snomed.info/sct|736253002"],
+    }
+
+    event = create_test_api_gateway_event(
+        headers=v2_headers,
+        body=doc_ref_data,
+    )
+
+    result = handler(event, create_mock_context())
+    body = result.pop("body")
+
+    assert result == {
+        "statusCode": "201",
+        "headers": {
+            "Location": "/DocumentReference/Y05868-00000000-0000-0000-0000-000000000001",
+            **default_response_headers(),
+        },
+        "isBase64Encoded": False,
+    }
+
+    parsed_body = json.loads(body)
+    assert parsed_body == {
+        "resourceType": "OperationOutcome",
+        "issue": [
+            {
+                "severity": "information",
+                "code": "informational",
+                "details": {
+                    "coding": [
+                        {
+                            "code": "RESOURCE_CREATED",
+                            "display": "Resource created",
+                            "system": "https://fhir.nhs.uk/ValueSet/NRL-ResponseCode",
+                        }
+                    ],
+                },
+                "diagnostics": "The document has been created",
+            }
+        ],
+    }
+
+
+@mock_aws
+@mock_repository
+@patch("nrlf.core.decorators.get_pointer_permissions_v2")
+def test_create_document_reference_pointer_type_not_allowed_v2(
+    get_pointer_permissions_mock, repository: DocumentPointerRepository
+):
+    doc_ref = load_document_reference("Y05868-736253002-Valid")
+
+    headers = create_headers(
+        additional_headers={
+            "nhsd-end-user-organisation-ods": "Y05868",
+            "nhsd-nrl-app-id": "Y05868-TestApp-12345678",
+        }
+    )
+    headers.pop("nhsd-client-rp-details")
+
+    # Return a type that does not match the document's type
+    get_pointer_permissions_mock.return_value = {
+        "access_controls": [],
+        "types": ["http://snomed.info/sct|736373009"],
+    }
+
+    event = create_test_api_gateway_event(
+        headers=headers,
+        body=doc_ref.model_dump_json(exclude_none=True),
+    )
+
+    result = handler(event, create_mock_context())
+    body = result.pop("body")
+
+    assert result == {
+        "statusCode": "403",
+        "headers": default_response_headers(),
+        "isBase64Encoded": False,
+    }
+
+    parsed_body = json.loads(body)
+
+    assert parsed_body == {
+        "resourceType": "OperationOutcome",
+        "issue": [
+            {
+                "severity": "error",
+                "code": "forbidden",
+                "details": {
+                    "coding": [
+                        {
+                            "code": "AUTHOR_CREDENTIALS_ERROR",
+                            "display": "Author credentials error",
+                            "system": "https://fhir.nhs.uk/CodeSystem/Spine-ErrorOrWarningCode",
+                        }
+                    ]
+                },
+                "diagnostics": "The type of the provided DocumentReference is not in the list of allowed types for this organisation",
+                "expression": ["type.coding[0].code"],
+            }
+        ],
+    }
+
+
 def test_create_document_reference_invalid_category_type():
     doc_ref = load_document_reference("Y05868-736253002-Valid")
 

@@ -52,11 +52,17 @@ def handler(
             expression="subject:identifier",
         )
 
-    if not validate_type(params.type, metadata.pointer_types):
+    allowed_types = (
+        metadata.nrl_permissions_policy.types
+        if metadata.nrl_permissions_policy
+        else metadata.pointer_types
+    )
+
+    if not validate_type(params.type, allowed_types):
         logger.log(
             LogReference.PROSEARCH002,
             type=params.type,
-            pointer_types=metadata.pointer_types,
+            pointer_types=allowed_types,
         )
         return SpineErrorResponse.INVALID_CODE_SYSTEM(
             diagnostics="Invalid query parameter (The provided type does not match the allowed types for this organisation)",
@@ -74,7 +80,7 @@ def handler(
             expression="category",
         )
 
-    pointer_types = [params.type.root] if params.type else metadata.pointer_types
+    pointer_types = [params.type.root] if params.type else allowed_types
     bundle = {"resourceType": "Bundle", "type": "searchset", "total": 0, "entry": []}
 
     logger.log(

@@ -55,6 +55,55 @@ def test_search_document_reference_happy_path(
     }
 
 
+@mock_aws
+@mock_repository
+@patch("nrlf.core.decorators.get_pointer_permissions_v2")
+def test_search_document_reference_happy_path_v2(
+    get_pointer_permissions_mock,
+    repository: DocumentPointerRepository,
+):
+    doc_ref = load_document_reference("Y05868-736253002-Valid")
+    doc_pointer = DocumentPointer.from_document_reference(doc_ref)
+    repository.create(doc_pointer)
+
+    v2_headers = create_headers(
+        additional_headers={
+            "nhsd-end-user-organisation-ods": "Y05868",
+            "nhsd-nrl-app-id": "Y05868-TestApp-12345678",
+        }
+    )
+    v2_headers.pop("nhsd-client-rp-details")
+
+    get_pointer_permissions_mock.return_value = {
+        "access_controls": [],
+        "types": ["http://snomed.info/sct|736253002"],
+    }
+
+    event = create_test_api_gateway_event(
+        headers=v2_headers,
+        query_string_parameters={
+            "subject:identifier": "https://fhir.nhs.uk/Id/nhs-number|6700028191",
+        },
+    )
+
+    result = handler(event, create_mock_context())
+    body = result.pop("body")
+
+    assert result == {
+        "statusCode": "200",
+        "headers": default_response_headers(),
+        "isBase64Encoded": False,
+    }
+
+    parsed_body = json.loads(body)
+    assert parsed_body == {
+        "resourceType": "Bundle",
+        "type": "searchset",
+        "total": 1,
+        "entry": [{"resource": doc_ref.model_dump(exclude_none=True)}],
+    }
+
+
 @mock_aws
 @mock_repository
 def test_search_document_reference_no_results(
@@ -462,6 +511,60 @@ def test_search_document_reference_filters_by_pointer_types(
     }
 
 
+@mock_aws
+@mock_repository
+@patch("nrlf.core.decorators.get_pointer_permissions_v2")
+def test_search_document_reference_filters_by_pointer_types_v2(
+    get_pointer_permissions_mock,
+    repository: DocumentPointerRepository,
+):
+    allowed_doc_ref = load_document_reference("Y05868-736253002-Valid")
+    allowed_pointer = DocumentPointer.from_document_reference(allowed_doc_ref)
+    repository.create(allowed_pointer)
+
+    disallowed_doc_ref = load_document_reference("Y05868-736253002-Valid")
+    assert disallowed_doc_ref.type and disallowed_doc_ref.type.coding
+    disallowed_doc_ref.type.coding[0].code = "861421000000109"
+    disallowed_doc_ref.type.coding[0].system = "http://snomed.info/sct"
+    disallowed_pointer = DocumentPointer.from_document_reference(disallowed_doc_ref)
+    disallowed_pointer.id = "Y05868-disallowed-type"
+    disallowed_pointer.type = "http://snomed.info/sct|861421000000109"
+    repository.create(disallowed_pointer)
+
+    v2_headers = create_headers(
+        additional_headers={
+            "nhsd-end-user-organisation-ods": "Y05868",
+            "nhsd-nrl-app-id": "Y05868-TestApp-12345678",
+        }
+    )
+    v2_headers.pop("nhsd-client-rp-details")
+
+    get_pointer_permissions_mock.return_value = {
+        "access_controls": [],
+        "types": ["http://snomed.info/sct|736253002"],
+    }
+
+    event = create_test_api_gateway_event(
+        headers=v2_headers,
+        query_string_parameters={
+            "subject:identifier": "https://fhir.nhs.uk/Id/nhs-number|6700028191",
+        },
+    )
+
+    result = handler(event, create_mock_context())
+    body = result.pop("body")
+
+    assert result == {
+        "statusCode": "200",
+        "headers": default_response_headers(),
+        "isBase64Encoded": False,
+    }
+
+    parsed_body = json.loads(body)
+    assert parsed_body["total"] == 1
+    assert parsed_body["entry"][0]["resource"]["id"] == allowed_doc_ref.id
+
+
 @mock_aws
 @mock_repository
 @patch("api.producer.searchDocumentReference.search_document_reference.logger")

@@ -46,11 +46,17 @@ def handler(
             expression="subject:identifier",
         )
 
-    if not validate_type(body.type, metadata.pointer_types):
+    allowed_types = (
+        metadata.nrl_permissions_policy.types
+        if metadata.nrl_permissions_policy
+        else metadata.pointer_types
+    )
+
+    if not validate_type(body.type, allowed_types):
         logger.log(
             LogReference.PROPOSTSEARCH002,
             type=body.type,
-            pointer_types=metadata.pointer_types,
+            pointer_types=allowed_types,
         )
         return SpineErrorResponse.INVALID_CODE_SYSTEM(
             diagnostics="The provided type does not match the allowed types for this organisation",
@@ -68,7 +74,7 @@ def handler(
             expression="category",
         )
 
-    pointer_types = [body.type.root] if body.type else metadata.pointer_types
+    pointer_types = [body.type.root] if body.type else allowed_types
     bundle = {"resourceType": "Bundle", "type": "searchset", "total": 0, "entry": []}
 
     logger.log(