Feature/cdapi 148

.github/actions/run-test-suite/action.yaml

@@ -17,6 +17,26 @@ inputs:
     description: "Environment: local or remote"
     required: false
     default: "remote"
+  apim_client_key_secret_name:
+    description: "Secret name of the APIM client certificate key (if needed)"
+    required: false
+    default: ""
+  apim_client_cert_secret_name:
+    description: "Secret name of the APIM client certificate (if needed)"
+    required: false
+    default: ""
+  pdm_mock_document_url:
+    description: "PDM mock document URL (if needed)"
+    required: false
+    default: ""
+  mns_mock_events_url:
+    description: "MNS mock events URL (if needed)"
+    required: false
+    default: ""
+  pdm_bundle_url:
+    description: "PDM bundle URL (if needed)"
+    required: false
+    default: ""
 
 runs:
   using: composite
@@ -27,11 +47,31 @@ runs:
         APIGEE_ACCESS_TOKEN: ${{ inputs.apigee-access-token }}
         ENV: ${{ inputs.env }}
         TEST_TYPE: ${{ inputs.test-type }}
+        CLIENT_KEY_NAME: ${{ inputs.apim_client_key_secret_name }}
+        CLIENT_CERT_NAME: ${{ inputs.apim_client_cert_secret_name }}
+        PDM_MOCK_DOCUMENT_URL: ${{ inputs.pdm_mock_document_url }}
+        MNS_MOCK_EVENTS_URL: ${{ inputs.mns_mock_events_url }}
+        PDM_BUNDLE_URL: ${{ inputs.pdm_bundle_url }}
       run: |
         if [[ -n "${APIGEE_ACCESS_TOKEN}" ]]; then
           echo "::add-mask::${APIGEE_ACCESS_TOKEN}"
         fi
-        make test-${TEST_TYPE}
+
+        if [[ -n "${CLIENT_KEY_NAME}" ]]; then
+          SECRET_NAME=${CLIENT_KEY_NAME//\//_}
+          SECRET_NAME=${SECRET_NAME//-/_}
+          echo "Using APIM client certificate key from name: ${SECRET_NAME}"
+          CLIENT_KEY=${!SECRET_NAME}
+        fi
+
+        if [[ -n "${CLIENT_CERT_NAME}" ]]; then
+          SECRET_NAME=${CLIENT_CERT_NAME//\//_}
+          SECRET_NAME=${SECRET_NAME//-/_}
+          echo "Using APIM client certificate from name: ${SECRET_NAME}"
+          CLIENT_CERT=${!SECRET_NAME}
+        fi
+
+        CLIENT_KEY=${CLIENT_KEY} CLIENT_CERT=${CLIENT_CERT} make test-${TEST_TYPE}
 
     - name: "Upload ${{ inputs.test-type }} test results"
       if: always()

.github/workflows/preview-env.yaml

@@ -677,9 +677,17 @@ jobs:
       - name: "Run integration tests"
         if: github.event.action != 'closed'
         uses: ./.github/actions/run-test-suite
+        env:
+          API_MTLS_CERT: ${{ secrets.API_MTLS_CERT }}
+          API_MTLS_KEY: ${{ secrets.API_MTLS_KEY }}
         with:
           test-type: integration
           apigee-access-token: ${{ steps.apigee-token.outputs.apigee-access-token }}
+          apim_client_cert_secret_name: "${{ env.API_MTLS_CERT || '/cds/pathology/dev/mtls/client1-key-public' }}"
+          apim_client_key_secret_name: "${{ env.API_MTLS_KEY || '/cds/pathology/dev/mtls/client1-key-secret' }}"
+          pdm_mock_document_url: ${{ steps.names.outputs.mock_preview_url }}/pdm/mock/Bundle
+          mns_mock_events_url: ${{ steps.names.outputs.mock_preview_url }}/mns/mock/event
+          pdm_bundle_url: ${{ steps.names.outputs.mock_preview_url }}/pdm/FHIR/R4/Bundle
 
       - name: "Run acceptance tests"
         if: github.event.action != 'closed'

.vscode/settings.json

@@ -78,5 +78,6 @@
   },
   // Disabling automatic port forwarding as the devcontainer should already have access to any required ports.
   "remote.autoForwardPorts": false,
-  "python-envs.defaultEnvManager": "ms-python.python:system"
+  "python-envs.defaultEnvManager": "ms-python.python:pyenv",
+  "python.terminal.activateEnvironment": false
 }

infrastructure/images/api-gateway-mock/resources/server.py

@@ -44,7 +44,7 @@
 def forward_request(path_params):
     x_correlation_id = request.headers.get("X-Correlation-ID", "")
     forwarded_headers = {k.lower(): v for k, v in request.headers.items()}
-    forwarded_headers["nhsd-correlation-id"] = x_correlation_id
+    forwarded_headers["nhsd-correlation-id"] = f".{x_correlation_id}.test"
 
     response = requests.post(
         f"{TARGET_URL}/2015-03-31/functions/function/invocations",
@@ -61,8 +61,9 @@ def forward_request(path_params):
             },
             "httpMethod": request.method,
             "rawPath": f"/{path_params}",
-            "rawQueryString": "",
+            "rawQueryString": request.query_string.decode("utf-8"),
             "pathParameters": {"proxy": path_params},
+            "queryStringParameters": request.args.to_dict(),
         },
         headers={"Content-Type": "application/json"},
         timeout=120,
@@ -75,11 +76,13 @@ def forward_request(path_params):
     app.logger.info("response: %s", response.text)
     response_data = response.json()
 
+    headers = {"x-correlation-id": x_correlation_id} | response_data.get("headers", {})
+
     output = (
         (
             response_data["body"],
             response_data["statusCode"],
-            response_data["headers"],
+            headers,
         )
         if "body" in response_data
         else (response_data, 500, {"Content-Type": "text/plain"})

mocks/src/pdm_mock/handler.py

@@ -114,7 +114,7 @@ def handle_post_request(payload: dict[str, Any]) -> PDMResponse:
     item: DocumentItem = {
         "sessionId": document_id,
         "expiresAt": int(time()) + DEFAULT_TTL,
-        "document": json.dumps(created_document),
+        "document": json.dumps(payload),
         "type": "pdm_document",
     }
 

pathology-api/openapi.yaml

@@ -232,10 +232,10 @@ paths:
                         identifier:
                           system: "https://fhir.nhs.uk/Id/nhs-number"
                           value: "9999999999"
-                        extension:
-                          - url: "http://hl7.eu/fhir/StructureDefinition/composition-basedOn-order-or-requisition"
-                            valueReference:
-                              reference: "ServiceRequest"
+                      extension:
+                        - url: "http://hl7.eu/fhir/StructureDefinition/composition-basedOn-order-or-requisition"
+                          valueReference:
+                            reference: "ServiceRequest"
                   - fullUrl: "ServiceRequest"
                     resource:
                       resourceType: ServiceRequest
@@ -250,8 +250,8 @@ paths:
                     resource:
                       resourceType: Organization
                       identifier:
-                        system: "https://fhir.nhs.uk/Id/ods-organization-code"
-                        value: "A12345"
+                        - system: "https://fhir.nhs.uk/Id/ods-organization-code"
+                          value: "A12345"
                   - fullUrl: "Patient"
                     resource:
                       resourceType: Patient
@@ -365,8 +365,8 @@ paths:
                         resource:
                           resourceType: Organization
                           identifier:
-                            system: "https://fhir.nhs.uk/Id/ods-organization-code"
-                            value: "A12345"
+                            - system: "https://fhir.nhs.uk/Id/ods-organization-code"
+                              value: "A12345"
                       - fullUrl: "Patient"
                         resource:
                           resourceType: Patient
@@ -565,20 +565,23 @@ components:
             - Organization
           example: Organization
         identifier:
-          type: object
-          required:
-            - system
-            - value
-          properties:
-            system:
-              type: string
-              enum:
-                - "https://fhir.nhs.uk/Id/ods-organization-code"
-              example: "https://fhir.nhs.uk/Id/ods-organization-code"
-            value:
-              type: string
-              example: "A12345"
-              description: ODS code of the requesting organisation
+          type: array
+          minItems: 1
+          items:
+            type: object
+            required:
+              - system
+              - value
+            properties:
+              system:
+                type: string
+                enum:
+                  - "https://fhir.nhs.uk/Id/ods-organization-code"
+                example: "https://fhir.nhs.uk/Id/ods-organization-code"
+              value:
+                type: string
+                example: "A12345"
+                description: ODS code of the requesting organisation
     OperationOutcome:
       type: object
       required:

pathology-api/tests/conftest.py

@@ -1,8 +1,9 @@
 """Pytest configuration and shared fixtures for pathology API tests."""
 
 import os
+from collections.abc import Callable
 from datetime import timedelta
-from typing import Any, Literal, Protocol, cast
+from typing import Any, Literal, Protocol
 
 import pytest
 import requests
@@ -50,6 +51,14 @@ def send_without_payload(
         """
         ...
 
+    @property
+    def auth_headers(self) -> dict[str, str] | None:
+        """
+        Return the authentication headers used by this client, or None if not
+        applicable.
+        """
+        ...
+
 
 class LocalClient:
     """HTTP client that sends requests to the Lambda via the RIE (no auth headers)."""
@@ -58,7 +67,7 @@ def __init__(
         self,
         lambda_url: str,
         headers: dict[str, str] | None = None,
-        timeout: timedelta = timedelta(seconds=1),
+        timeout: timedelta = timedelta(seconds=10),
     ):
         self._lambda_url = lambda_url
         self._default_headers = {"Content-Type": "application/fhir+json"} | (
@@ -97,6 +106,10 @@ def send_without_payload(
             headers=headers,
         )
 
+    @property
+    def auth_headers(self) -> None:
+        return None
+
     def _send(
         self,
         data: str | None,
@@ -181,6 +194,10 @@ def send_without_payload(
             headers=headers,
         )
 
+    @property
+    def auth_headers(self) -> dict[str, str]:
+        return self._default_headers
+
     def _send(
         self,
         data: str | None,
@@ -209,15 +226,32 @@ def _send(
 
 
 @pytest.fixture(scope="module")
-def base_url() -> str:
+def fetch_env_variable[T]() -> Callable[[str, type[T]], T]:
+    def _fetch_env_variable(name: str, required_type: type[T]) -> T:
+        value = os.getenv(name)
+        if not value:
+            raise ValueError(f"{name} environment variable is not set.")
+
+        if not isinstance(value, required_type):
+            raise ValueError(
+                f"{name} environment variable is not required type {required_type}"
+            )
+
+        return value
+
+    return _fetch_env_variable
+
+
+@pytest.fixture(scope="module")
+def base_url(fetch_env_variable: Callable[[str, type[str]], str]) -> str:
     """Retrieves the base URL of the currently deployed application."""
-    return _fetch_env_variable("BASE_URL", str)
+    return fetch_env_variable("BASE_URL", str)
 
 
 @pytest.fixture
-def hostname() -> str:
+def hostname(fetch_env_variable: Callable[[str, type[str]], str]) -> str:
     """Retrieves the hostname of the currently deployed application."""
-    return _fetch_env_variable("HOST", str)
+    return fetch_env_variable("HOST", str)
 
 
 @pytest.fixture
@@ -280,13 +314,6 @@ def _create_remote_client(request: pytest.FixtureRequest) -> RemoteClient:
     )
 
 
-def _fetch_env_variable[T](name: str, _: type[T]) -> T:
-    value = os.getenv(name)
-    if not value:
-        raise ValueError(f"{name} environment variable is not set.")
-    return cast("T", value)
-
-
 def pytest_addoption(parser: pytest.Parser) -> None:
     parser.addoption(
         "--env",

pathology-api/tests/integration/conftest.py

@@ -0,0 +1,67 @@
+import os
+import tempfile
+from collections.abc import Callable, Generator
+from datetime import timedelta
+
+import pytest
+
+from tests.mock_client import CertificateDetails, MNSMockClient, PDMMockClient
+
+
+@pytest.fixture(scope="module")
+def client_cert() -> Generator[CertificateDetails | None, None, None]:
+    client_cert = os.getenv("CLIENT_CERT")
+    client_key = os.getenv("CLIENT_KEY")
+
+    if client_cert and client_key:
+        with (
+            tempfile.NamedTemporaryFile(delete=True) as cert_file,
+            tempfile.NamedTemporaryFile(delete=True) as key_file,
+        ):
+            cert_file.write(client_cert.encode())
+            cert_file.flush()
+            key_file.write(client_key.encode())
+            key_file.flush()
+            yield {
+                "cert_path": cert_file.name,
+                "key_path": key_file.name,
+            }
+    else:
+        yield None
+
+
+@pytest.fixture(scope="module")
+def pdm_mock_document_url(fetch_env_variable: Callable[[str, type[str]], str]) -> str:
+    return fetch_env_variable("PDM_MOCK_DOCUMENT_URL", str)
+
+
+@pytest.fixture(scope="module")
+def mns_mock_events_url(fetch_env_variable: Callable[[str, type[str]], str]) -> str:
+    return fetch_env_variable("MNS_MOCK_EVENTS_URL", str)
+
+
+@pytest.fixture(scope="module")
+def pdm_bundle_url(fetch_env_variable: Callable[[str, type[str]], str]) -> str:
+    return fetch_env_variable("PDM_BUNDLE_URL", str)
+
+
+@pytest.fixture(scope="module")
+def pdm_mock_client(
+    client_cert: CertificateDetails | None, pdm_mock_document_url: str
+) -> PDMMockClient:
+    return PDMMockClient(
+        document_url=pdm_mock_document_url,
+        timeout=timedelta(seconds=5),
+        client_cert=client_cert,
+    )
+
+
+@pytest.fixture(scope="module")
+def mns_mock_client(
+    client_cert: CertificateDetails | None, mns_mock_events_url: str
+) -> MNSMockClient:
+    return MNSMockClient(
+        events_url=mns_mock_events_url,
+        timeout=timedelta(seconds=5),
+        client_cert=client_cert,
+    )