Route pseudonym operations through PseudonymReferralService (#609)

- Add PseudonymReferralService, which resolves the pseudonym and calls ReferralService
- Routers and LocalizationListService no longer resolve pseudonyms themselves
- Remove the unused get_referral_service dependency

Author: thomas-samoht

app/container.py

@@ -15,6 +15,7 @@
 from app.services.fhir.bundle import BundleService
 from app.services.fhir.localization_list import LocalizationListService
 from app.services.key_info import KeyInfoService, KeyInfoServiceMock
+from app.services.pseudonym_referral_service import PseudonymReferralService
 from app.services.pseudonym_resolver import PseudonymResolver
 from app.services.referral_service import ReferralService
 from app.telemetry import create_meter_provider
@@ -55,11 +56,15 @@ def container_config(binder: inject.Binder) -> None:
         crypto_client=crypto_client,
         key_info_service=key_info_service,
     )
-    binder.bind(PseudonymResolver, pseudonym_resolver)
+    pseudonym_referral_service = PseudonymReferralService(
+        referral_service=referral_service,
+        pseudonym_resolver=pseudonym_resolver,
+    )
+    binder.bind(PseudonymReferralService, pseudonym_referral_service)
 
     localization_list_service = LocalizationListService(
         referral_service=referral_service,
-        pseudonym_resolver=pseudonym_resolver,
+        pseudonym_referral_service=pseudonym_referral_service,
         default_page_size=config.pagination.default_page_size,
         max_page_size=config.pagination.max_page_size,
     )

app/dependencies.py

@@ -9,8 +9,7 @@
 from app.services.fhir.bundle import BundleService
 from app.services.fhir.localization_list import LocalizationListService
 from app.services.key_info import KeyInfoService
-from app.services.pseudonym_resolver import PseudonymResolver
-from app.services.referral_service import ReferralService
+from app.services.pseudonym_referral_service import PseudonymReferralService
 from app.utils.load_capability_statement import CapabilityStatement
 
 
@@ -22,10 +21,6 @@ def get_database() -> Database:
     return inject.instance(Database)
 
 
-def get_referral_service() -> ReferralService:
-    return inject.instance(ReferralService)
-
-
 def get_key_info_service() -> KeyInfoService:
     return inject.instance(KeyInfoService)
 
@@ -34,8 +29,8 @@ def get_crypto_service_api_client() -> CryptoServiceApiClient:
     return inject.instance(CryptoServiceApiClient)
 
 
-def get_pseudonym_resolver() -> PseudonymResolver:
-    return inject.instance(PseudonymResolver)
+def get_pseudonym_referral_service() -> PseudonymReferralService:
+    return inject.instance(PseudonymReferralService)
 
 
 def get_auth_header_service() -> AuthHeaderService:

app/models/fhir/resources/localization_list/request.py

@@ -9,6 +9,7 @@
     DEVICE_SYSTEM,
     PSEUDONYM_SYSTEM,
 )
+from app.models.pseudonym import PseudonymToken
 
 logger = logging.getLogger(__name__)
 
@@ -90,6 +91,9 @@ def empty(self) -> bool:
     def is_localize_params(self) -> bool:
         return self.subject is not None and self.source is None
 
+    def subject_token(self) -> PseudonymToken | None:
+        return PseudonymToken(self.subject) if self.subject else None
+
 
 class LocalizationListSearchParams(LocalizationListParams):
     """Search parameters for a List search, which also controls the page that is returned."""

app/routers/localize.py

@@ -2,29 +2,22 @@
 
 from fastapi import APIRouter, Body, Depends
 
-from app.dependencies import (
-    get_pseudonym_resolver,
-    get_referral_service,
-)
+from app.dependencies import get_pseudonym_referral_service
 from app.models.auth.context import AuthContext
 from app.models.auth.data import AuthorizationScope
 from app.models.registrations import LocalizeRequest, Registration
 from app.routers.dependencies import require_scope
-from app.services.pseudonym_resolver import PseudonymResolver
-from app.services.referral_service import ReferralService
+from app.services.pseudonym_referral_service import PseudonymReferralService
 
 router = APIRouter(tags=["Localization"], prefix="/localize")
 
 
 @router.post("")
 def localize(
     data: Annotated[LocalizeRequest, Body()],
-    referral_service: Annotated[ReferralService, Depends(get_referral_service)],
-    pseudonym_resolver: Annotated[PseudonymResolver, Depends(get_pseudonym_resolver)],
+    pseudonym_referral_service: Annotated[PseudonymReferralService, Depends(get_pseudonym_referral_service)],
     ctx: Annotated[AuthContext, Depends(require_scope(AuthorizationScope.LOCALIZE))],
 ) -> Any:
-    resolved = pseudonym_resolver.resolve(data.oprf_pseudonym())
-
-    _, results = referral_service.localize(resolved.encrypted, ctx.claims.ura_number)
+    _, results = pseudonym_referral_service.localize(data.oprf_pseudonym(), ctx.claims.ura_number)
 
     return [Registration.from_entity(r) for r in results]

app/routers/registrations.py

@@ -2,10 +2,7 @@
 
 from fastapi import APIRouter, Body, Depends, Query, Response
 
-from app.dependencies import (
-    get_pseudonym_resolver,
-    get_referral_service,
-)
+from app.dependencies import get_pseudonym_referral_service
 from app.models.auth.context import AuthContext
 from app.models.auth.data import AuthorizationScope
 from app.models.registrations import (
@@ -15,8 +12,7 @@
     RegistrationQueryParams,
 )
 from app.routers.dependencies import require_managing_source, require_scope
-from app.services.pseudonym_resolver import PseudonymResolver
-from app.services.referral_service import ReferralService
+from app.services.pseudonym_referral_service import PseudonymReferralService
 
 router = APIRouter(tags=["Registrations"], prefix="/registrations")
 
@@ -25,14 +21,11 @@
     "",
 )
 def get_registration(
-    referral_service: Annotated[ReferralService, Depends(get_referral_service)],
-    pseudonym_resolver: Annotated[PseudonymResolver, Depends(get_pseudonym_resolver)],
+    pseudonym_referral_service: Annotated[PseudonymReferralService, Depends(get_pseudonym_referral_service)],
     params: Annotated[RegistrationQueryParams, Query()],
     ctx: Annotated[AuthContext, Depends(require_scope(AuthorizationScope.READ))],
 ) -> Any:
-    resolved = pseudonym_resolver.resolve(params.oprf_pseudonym())
-
-    _, results = referral_service.query(ctx.claims.ura_number, encrypted_pseudonym=resolved.encrypted)
+    _, results = pseudonym_referral_service.query(ctx.claims.ura_number, pseudonym=params.oprf_pseudonym())
 
     return RegistrationList.from_entities(results)
 
@@ -45,18 +38,14 @@ def get_registration(
 def add_registration(
     data: Annotated[CreateRegistrationRequest, Body()],
     response: Response,
-    referral_service: Annotated[ReferralService, Depends(get_referral_service)],
-    pseudonym_resolver: Annotated[PseudonymResolver, Depends(get_pseudonym_resolver)],
+    pseudonym_referral_service: Annotated[PseudonymReferralService, Depends(get_pseudonym_referral_service)],
     ctx: Annotated[AuthContext, Depends(require_scope(AuthorizationScope.CREATE))],
     source: Annotated[str, Depends(require_managing_source)],
 ) -> Any:
-    resolved = pseudonym_resolver.resolve(data.oprf_pseudonym())
-
-    referral, created = referral_service.add_one(
-        encrypted_pseudonym=resolved.encrypted,
+    referral, created = pseudonym_referral_service.register(
+        data.oprf_pseudonym(),
         ura_number=ctx.claims.ura_number,
         source=source,
-        key_id=resolved.key_id,
     )
     if not created:
         response.status_code = 200
@@ -66,16 +55,13 @@ def add_registration(
 @router.delete("")
 def delete_registration(
     params: Annotated[RegistrationQueryParams, Query()],
-    referral_service: Annotated[ReferralService, Depends(get_referral_service)],
-    pseudonym_resolver: Annotated[PseudonymResolver, Depends(get_pseudonym_resolver)],
+    pseudonym_referral_service: Annotated[PseudonymReferralService, Depends(get_pseudonym_referral_service)],
     ctx: Annotated[AuthContext, Depends(require_scope(AuthorizationScope.DELETE))],
     source: Annotated[str, Depends(require_managing_source)],
 ) -> Any:
-    resolved = pseudonym_resolver.resolve(params.oprf_pseudonym())
-
-    referral_service.delete_many(
-        ura_number=ctx.claims.ura_number,
-        encrypted_pseudonym=resolved.encrypted,
+    pseudonym_referral_service.delete_many(
+        ctx.claims.ura_number,
+        pseudonym=params.oprf_pseudonym(),
         source=source,
     )
 

app/services/fhir/localization_list.py

@@ -17,7 +17,7 @@
 from app.models.pseudonym import PseudonymToken
 from app.models.ura import UraNumber
 from app.services.exceptions import UnauthorizedUraError
-from app.services.pseudonym_resolver import PseudonymResolver, ResolvedPseudonym
+from app.services.pseudonym_referral_service import PseudonymReferralService
 from app.services.referral_service import ReferralService
 
 logger = logging.getLogger(__name__)
@@ -27,12 +27,12 @@ class LocalizationListService:
     def __init__(
         self,
         referral_service: ReferralService,
-        pseudonym_resolver: PseudonymResolver,
+        pseudonym_referral_service: PseudonymReferralService,
         default_page_size: int = 50,
         max_page_size: int = 100,
     ) -> None:
         self.referral_service = referral_service
-        self._pseudonym_resolver = pseudonym_resolver
+        self.pseudonym_referral_service = pseudonym_referral_service
         self.default_page_size = default_page_size
         self.max_page_size = max_page_size
 
@@ -54,13 +54,10 @@ def create(
             )
             raise UnauthorizedUraError("Registration not linked to the authorized URA")
 
-        resolved = self._pseudonym_resolver.resolve(PseudonymToken(data.get_encoded_pseudonym()))
-
-        referral, created = self.referral_service.add_one(
+        referral, created = self.pseudonym_referral_service.register(
+            PseudonymToken(data.get_encoded_pseudonym()),
             ura_number=ura_number,
-            encrypted_pseudonym=resolved.encrypted,
             source=device,
-            key_id=resolved.key_id,
         )
 
         return LocalizationList.from_referral(referral), created
@@ -79,23 +76,16 @@ def query(
 
         When `request_url` is given, the bundle links to the current, next and previous page.
         """
-        resolved: ResolvedPseudonym | None = None
-        if params.subject:
-            resolved = self._pseudonym_resolver.resolve(PseudonymToken(params.subject))
-
+        subject = params.subject_token()
         page_size = min(params.count or self.default_page_size, self.max_page_size)
 
-        if params.is_localize_params() and resolved is not None:
-            total, referrals = self.referral_service.localize(
-                resolved.encrypted, authenticated_ura, limit=page_size, offset=params.offset
+        if params.is_localize_params() and subject is not None:
+            total, referrals = self.pseudonym_referral_service.localize(
+                subject, authenticated_ura, limit=page_size, offset=params.offset
             )
         else:
-            total, referrals = self.referral_service.query(
-                authenticated_ura,
-                encrypted_pseudonym=(resolved.encrypted if resolved else None),
-                source=params.source,
-                limit=page_size,
-                offset=params.offset,
+            total, referrals = self.pseudonym_referral_service.query(
+                authenticated_ura, pseudonym=subject, source=params.source, limit=page_size, offset=params.offset
             )
 
         bundle = Bundle(
@@ -146,14 +136,10 @@ def delete_by_query(
         authenticated_ura: UraNumber,
         source: str,
     ) -> tuple[OperationOutcome, int]:
-        resolved: ResolvedPseudonym | None = None
-        if params.subject:
-            resolved = self._pseudonym_resolver.resolve(PseudonymToken(params.subject))
-
-        deleted_count = self.referral_service.delete_many(
-            encrypted_pseudonym=(resolved.encrypted if resolved else None),
+        deleted_count = self.pseudonym_referral_service.delete_many(
+            authenticated_ura,
+            pseudonym=params.subject_token(),
             source=source,
-            ura_number=authenticated_ura,
         )
 
         if deleted_count < 1:

app/services/pseudonym_referral_service.py

@@ -0,0 +1,57 @@
+from collections.abc import Sequence
+
+from app.db.models.referral import ReferralEntity
+from app.models.pseudonym import BlindedPseudonym, EncryptedPseudonym
+from app.models.ura import UraNumber
+from app.services.pseudonym_resolver import PseudonymResolver
+from app.services.referral_service import ReferralService
+
+
+class PseudonymReferralService:
+    def __init__(self, referral_service: ReferralService, pseudonym_resolver: PseudonymResolver) -> None:
+        self._referral_service = referral_service
+        self._pseudonym_resolver = pseudonym_resolver
+
+    def register(
+        self,
+        pseudonym: BlindedPseudonym,
+        ura_number: UraNumber,
+        source: str,
+    ) -> tuple[ReferralEntity, bool]:
+        resolved = self._pseudonym_resolver.resolve(pseudonym)
+        return self._referral_service.add_one(resolved.encrypted, ura_number, source, resolved.key_id)
+
+    def localize(
+        self,
+        pseudonym: BlindedPseudonym,
+        requesting_ura: UraNumber,
+        limit: int | None = None,
+        offset: int = 0,
+    ) -> tuple[int, Sequence[ReferralEntity]]:
+        encrypted = self._resolve_encrypted(pseudonym)
+        return self._referral_service.localize(encrypted, requesting_ura, limit=limit, offset=offset)
+
+    def query(
+        self,
+        ura_number: UraNumber,
+        pseudonym: BlindedPseudonym | None = None,
+        source: str | None = None,
+        limit: int | None = None,
+        offset: int = 0,
+    ) -> tuple[int, Sequence[ReferralEntity]]:
+        encrypted = self._resolve_encrypted(pseudonym) if pseudonym else None
+        return self._referral_service.query(
+            ura_number, encrypted_pseudonym=encrypted, source=source, limit=limit, offset=offset
+        )
+
+    def delete_many(
+        self,
+        ura_number: UraNumber,
+        pseudonym: BlindedPseudonym | None = None,
+        source: str | None = None,
+    ) -> int:
+        encrypted = self._resolve_encrypted(pseudonym) if pseudonym else None
+        return self._referral_service.delete_many(ura_number, encrypted_pseudonym=encrypted, source=source)
+
+    def _resolve_encrypted(self, pseudonym: BlindedPseudonym) -> EncryptedPseudonym:
+        return self._pseudonym_resolver.resolve(pseudonym).encrypted

tests/conftest.py

@@ -15,6 +15,7 @@
 from app.db.models.referral import ReferralEntity
 from app.db.repository.key_info_repository import KeyInfoRepository
 from app.db.repository.referral_repository import ReferralRepository
+from app.debug.crypto_service_api_client_mock import CryptoServiceApiClientMock
 from app.logging.context import CLAIM_FIELDS
 from app.logging.events import Log
 from app.metrics import UsageMetrics
@@ -39,6 +40,8 @@
 from app.services.auth.header import AuthHeaderService
 from app.services.http import HttpService
 from app.services.key_info import KeyInfoService
+from app.services.pseudonym_referral_service import PseudonymReferralService
+from app.services.pseudonym_resolver import PseudonymResolver
 from app.services.referral_service import ReferralService
 from tests.test_config import get_test_config
 
@@ -197,6 +200,14 @@ def key_info_service(database: Database) -> KeyInfoService:
     return KeyInfoService(database)
 
 
+@pytest.fixture
+def pseudonym_referral_service(
+    referral_service: ReferralService, key_info_service: KeyInfoService
+) -> PseudonymReferralService:
+    resolver = PseudonymResolver(crypto_client=CryptoServiceApiClientMock(), key_info_service=key_info_service)
+    return PseudonymReferralService(referral_service=referral_service, pseudonym_resolver=resolver)
+
+
 @pytest.fixture()
 def auth_header_service() -> AuthHeaderService:
     config = get_test_config()