Skip to content

Commit a61feb1

Browse files
clewis1clewis1
authored
Merge pull request #182 from companieshouse/feature/return-internal-id-if-api-key
Full record to return internal_id when using api key.
2 parents 893259a + 39c5c19 commit a61feb1

File tree

3 files changed

+84
-8
lines changed

3 files changed

+84
-8
lines changed

‎src/main/java/uk/gov/companieshouse/pscdataapi/config/WebSecurityConfig.java‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
import org.springframework.beans.factory.annotation.Value;
77
import org.springframework.context.annotation.Bean;
88
import org.springframework.context.annotation.Configuration;
9+
import org.springframework.context.annotation.Primary;
910
import org.springframework.http.HttpMethod;
1011
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
1112
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
@@ -17,6 +18,7 @@
1718
import uk.gov.companieshouse.api.filter.CustomCorsFilter;
1819
import uk.gov.companieshouse.api.interceptor.InternalUserInterceptor;
1920
import uk.gov.companieshouse.api.interceptor.UserAuthenticationInterceptor;
21+
import uk.gov.companieshouse.pscdataapi.interceptor.AuthenticationHelper;
2022
import uk.gov.companieshouse.pscdataapi.interceptor.AuthenticationHelperImpl;
2123
import uk.gov.companieshouse.pscdataapi.interceptor.FullRecordAuthenticationInterceptor;
2224

@@ -60,7 +62,9 @@ public FullRecordAuthenticationInterceptor fullRecordAuthenticationInterceptor()
6062
return new FullRecordAuthenticationInterceptor(authenticationHelper());
6163
}
6264

63-
public AuthenticationHelperImpl authenticationHelper() {
65+
@Bean
66+
@Primary
67+
public AuthenticationHelper authenticationHelper() {
6468
return new AuthenticationHelperImpl();
6569
}
6670

‎src/main/java/uk/gov/companieshouse/pscdataapi/controller/CompanyPscFullRecordGetController.java‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
package uk.gov.companieshouse.pscdataapi.controller;
22

3+
import jakarta.servlet.http.HttpServletRequest;
34
import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
45
import org.springframework.http.ResponseEntity;
56
import org.springframework.web.bind.annotation.GetMapping;
@@ -10,6 +11,7 @@
1011
import uk.gov.companieshouse.logging.Logger;
1112
import uk.gov.companieshouse.logging.LoggerFactory;
1213
import uk.gov.companieshouse.pscdataapi.exceptions.ResourceNotFoundException;
14+
import uk.gov.companieshouse.pscdataapi.interceptor.AuthenticationHelper;
1315
import uk.gov.companieshouse.pscdataapi.logging.DataMapHolder;
1416
import uk.gov.companieshouse.pscdataapi.service.CompanyPscService;
1517

@@ -20,11 +22,14 @@
2022
public class CompanyPscFullRecordGetController {
2123
private static final Logger LOGGER = LoggerFactory.getLogger("psc-data-api");
2224
private static final String GETTING_FULL_RECORD_PSC_DATA_WITH_COMPANY_NUMBER = "Getting Full record PSC data with company number %s";
25+
public static final String OAUTH_2 = "oauth2";
2326

2427
private final CompanyPscService pscService;
28+
private final AuthenticationHelper authHelper;
2529

26-
public CompanyPscFullRecordGetController(final CompanyPscService pscService) {
30+
public CompanyPscFullRecordGetController(final CompanyPscService pscService, AuthenticationHelper authHelper) {
2731
this.pscService = pscService;
32+
this.authHelper = authHelper;
2833
}
2934

3035
/**
@@ -37,14 +42,21 @@ public CompanyPscFullRecordGetController(final CompanyPscService pscService) {
3742
@GetMapping("/individual/{notification_id}/full_record")
3843
public ResponseEntity<PscIndividualFullRecordApi> getIndividualFullRecordPscData(
3944
@PathVariable("company_number") final String companyNumber,
40-
@PathVariable("notification_id") final String notificationId) {
45+
@PathVariable("notification_id") final String notificationId,
46+
final HttpServletRequest request) {
47+
48+
final String identityType = authHelper.getAuthorisedIdentityType(request);
4149
DataMapHolder.get()
4250
.companyNumber(companyNumber)
4351
.itemId(notificationId);
4452
LOGGER.info(String.format(GETTING_FULL_RECORD_PSC_DATA_WITH_COMPANY_NUMBER, companyNumber),
4553
DataMapHolder.getLogMap());
4654
try {
4755
final PscIndividualFullRecordApi individualFullRecord = pscService.getIndividualFullRecord(companyNumber, notificationId);
56+
57+
if (identityType.equals(OAUTH_2)) {
58+
individualFullRecord.setInternalId(null);
59+
}
4860
return ResponseEntity.ok(individualFullRecord);
4961
} catch (final ResourceNotFoundException ex) {
5062
LOGGER.error(ex.getMessage(), DataMapHolder.getLogMap());

‎src/test/java/uk/gov/companieshouse/pscdataapi/controller/CompanyPscFullRecordGetControllerTest.java‎

Lines changed: 65 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -37,9 +37,11 @@ class CompanyPscFullRecordGetControllerTest {
3737
private static final String MOCK_COMPANY_NUMBER = "1234567";
3838
private static final String MOCK_NOTIFICATION_ID = "123456789";
3939
private static final String ERIC_IDENTITY = "Test-Identity";
40-
private static final String ERIC_IDENTITY_TYPE = "key";
40+
private static final String ERIC_IDENTITY_TYPE_API_KEY = "key";
41+
private static final String ERIC_IDENTITY_TYPE_OAUTH2 = "oauth2";
4142
private static final String ERIC_PRIVILEGES = "*";
4243
private static final String ERIC_AUTH_SENSITIVE = "sensitive-data";
44+
private static final String ERIC_AUTHORISED_TOKEN_PERMISSIONS_HEADER = "company_pscs=readprotected user_profile=read";
4345

4446
private static final String GET_INDIVIDUAL_FULL_RECORD_URL = String.format(
4547
"/company/%s/persons-with-significant-control/individual/%s/full_record", MOCK_COMPANY_NUMBER,
@@ -58,8 +60,8 @@ void contextLoads() {
5860
}
5961

6062
@Test
61-
@DisplayName("Should return 200 status with full record data")
62-
void getIndividualPSC() throws Exception {
63+
@DisplayName("Should return 200 status with full record data when eric_identity_type=key")
64+
void getIndividualPSCWithApiKey() throws Exception {
6365
when(companyPscService.getIndividualFullRecord(MOCK_COMPANY_NUMBER, MOCK_NOTIFICATION_ID)).thenReturn(
6466
createFullRecord());
6567

@@ -105,7 +107,7 @@ void getIndividualPSC() throws Exception {
105107
""";
106108

107109
mockMvc.perform(get(GET_INDIVIDUAL_FULL_RECORD_URL).header("ERIC-Identity", ERIC_IDENTITY)
108-
.header("ERIC-Identity-Type", ERIC_IDENTITY_TYPE)
110+
.header("ERIC-Identity-Type", ERIC_IDENTITY_TYPE_API_KEY)
109111
.contentType(APPLICATION_JSON)
110112
.header("x-request-id", X_REQUEST_ID)
111113
.header("ERIC-Authorised-Key-Roles", ERIC_PRIVILEGES)
@@ -114,6 +116,64 @@ void getIndividualPSC() throws Exception {
114116
.andExpect(content().json(expectedData, true));
115117
}
116118

119+
@Test
120+
@DisplayName("Should return 200 status with full record data when eric_identity_type=oauth2")
121+
void getIndividualPSCWithOauth2() throws Exception {
122+
when(companyPscService.getIndividualFullRecord(MOCK_COMPANY_NUMBER, MOCK_NOTIFICATION_ID)).thenReturn(
123+
createFullRecord());
124+
125+
final String expectedData = """
126+
{
127+
"kind": "individual-person-with-significant-control",
128+
"date_of_birth": {
129+
"day": 1,
130+
"month": 2,
131+
"year": 2000
132+
},
133+
"name": "Andy Bob Smith",
134+
"name_elements": {
135+
"surname": "Smith",
136+
"forename": "Andy",
137+
"middle_name": "Bob"
138+
},
139+
"links": {
140+
"self": "/company/123/persons-with-significant-control/456"
141+
},
142+
"nationality": "British",
143+
"service_address": {
144+
"address_line_1": "addressLine1",
145+
"postal_code": "CF12 3AB",
146+
"premises": "1"
147+
},
148+
"natures_of_control": [
149+
"nature of my control"
150+
],
151+
"usual_residential_address": {
152+
"address_line_1": "Home street",
153+
"postal_code": "AB12 3CD",
154+
"premises": "Cottage"
155+
},
156+
"residential_address_same_as_service_address": false,
157+
"verification_state": {
158+
"verification_status": "VERIFIED",
159+
"verification_start_date": "2025-01-10",
160+
"verification_statement_due_date": "2025-02-05"
161+
}
162+
}
163+
""";
164+
165+
mockMvc.perform(get(GET_INDIVIDUAL_FULL_RECORD_URL).header("ERIC-Identity", ERIC_IDENTITY)
166+
.header("ERIC-Identity-Type", ERIC_IDENTITY_TYPE_OAUTH2)
167+
.contentType(APPLICATION_JSON)
168+
.header("x-request-id", X_REQUEST_ID)
169+
.header("ERIC-Authorised-Key-Roles", ERIC_PRIVILEGES)
170+
.header("ERIC-Authorised-Key-Privileges", ERIC_AUTH_SENSITIVE)
171+
.header("ERIC-Authorised-Token-Permissions", ERIC_AUTHORISED_TOKEN_PERMISSIONS_HEADER)).andExpect(status().isOk())
172+
.andDo(print())
173+
.andExpect(content().json(expectedData, true));
174+
}
175+
176+
117177
@Test
118178
@DisplayName("Should return 404 when Individual PSC not found")
119179
void shouldReturn404WhenIndividualPscNotFound() throws Exception {
@@ -122,7 +182,7 @@ void shouldReturn404WhenIndividualPscNotFound() throws Exception {
122182
"Individual PSC document not found in Mongo with id " + MOCK_NOTIFICATION_ID));
123183

124184
mockMvc.perform(get(GET_INDIVIDUAL_FULL_RECORD_URL).header("ERIC-Identity", ERIC_IDENTITY)
125-
.header("ERIC-Identity-Type", ERIC_IDENTITY_TYPE)
185+
.header("ERIC-Identity-Type", ERIC_IDENTITY_TYPE_API_KEY)
126186
.contentType(APPLICATION_JSON)
127187
.header("x-request-id", X_REQUEST_ID)
128188
.header("ERIC-Authorised-Key-Roles", ERIC_PRIVILEGES)

0 commit comments

Comments
 (0)