Feature/add scope filter

jwt_proxy/api.py

@@ -2,12 +2,41 @@
 import jwt
 import requests
 import json
+import re
 
 from jwt_proxy.audit import audit_HAPI_change
 
 blueprint = Blueprint('auth', __name__)
 SUPPORTED_METHODS = ('GET', 'POST', 'PUT', 'DELETE', 'OPTIONS')
 
+# TODO: to be pulled into its own module and loaded per config
+def scope_filter(req, token):
+    # Check path
+    resource_pattern = rf"(Patient|DocumentReference)$"
+    if re.search(resource_pattern, req.path) is None:
+        return False
+
+    user_id = token.get("sub")
+    identifier_pattern = rf"(https(:|%3[Aa])(\/|%2[Ff]){2}keycloak\.ltt\.cirg\.uw\.edu(%7[Cc]|\|))?{user_id}"
+    # Search params for keycloak id
+    params = req.args
+    id_param_value = params.get("identifier", params.get("_identifier", params.get("subject.identifier")))
+    if id_param_value is not None and re.search(identifier_pattern, id_param_value):
+        return True
+    # Search body for keycloak id
+    if req.is_json:
+        try:
+            body = req.get_json()
+        except (ValueError, TypeError):
+            return False
+        resource_type = body.get("resourceType")
+        if resource_type == "DocumentReference":
+            reference_string = body.get("subject", {}).get("reference")
+            if reference_string is not None and re.search(identifier_pattern, reference_string):
+                return True
+    return False
+
+
 
 def proxy_request(req, upstream_url, user_info=None):
     """Forward request to given url"""
@@ -67,13 +96,16 @@ def validate_jwt(relative_path):
         )
     except jwt.exceptions.ExpiredSignatureError:
         return jsonify(message="token expired"), 401
-
-    response_content = proxy_request(
-        req=request,
-        upstream_url=f"{current_app.config['UPSTREAM_SERVER']}/{relative_path}",
-        user_info=decoded_token.get("email") or decoded_token.get("preferred_username"),
-    )
-    return response_content
+
+    # TODO: call new function here to dynamically load a filter call dependent on config; hardwired for now
+    if scope_filter(request, decoded_token):
+        response_content = proxy_request(
+            req=request,
+            upstream_url=f"{current_app.config['UPSTREAM_SERVER']}/{relative_path}",
+            user_info=decoded_token.get("email") or decoded_token.get("preferred_username"),
+        )
+        return response_content
+    return jsonify(message="invalid request"), 400
 
 
 @blueprint.route("/fhir/.well-known/smart-configuration")